Description of problem: Yubikey neo is no longer accessible by user. Device apparently not getting user permissions turned on after insertion. Version-Release number of selected component (if applicable): ykpers-1.17.2-2.fc22.x86_64 How reproducible: every time Steps to Reproduce: 1. insert yubikey 2. gpg --card-status 3. Actual results: failure with error $ gpg --card-status gpg: selecting openpgp failed: ec=6.108 gpg: OpenPGP card not available: general error Expected results: success with output like: $ gpg --card-status Application ID ...: D27...0 Version ..........: 2.0 Manufacturer .....: unknown ... Additional info: problem goes away when permssions are forced, either with sudo gpg --card-status or chmod `whoami` /dev/bus/usb/001/040 where BUS and DEV appear in journalctl journalctl has errors, see the "udevd" and "failed to execute" below: Oct 16 21:04:30 localhost kernel: input: Yubico Yubikey NEO OTP+U2F+CCID as /devices/pci0000:00/0000:00:14.0/usb1/1-2/12:1.0/0003:1050:0116.0035/input/input55 Oct 16 21:04:30 localhost kernel: hid-generic 0003:1050:0116.0035: input,hidraw5: USB HID v1.10 Keyboard [Yubico Yubikey NEO OTP+U2F+CCID] on usb-0000:00:14.0-2/input0 Oct 16 21:04:30 localhost kernel: hid-generic 0003:1050:0116.0036: hiddev0,hidraw6: USB HID v1.10 Device [Yubico Yubikey NEO OTP+U2F+CCID] on usb-0000:00:14.0-2/input1 Oct 16 21:04:30 localhost mtp-probe[23495]: checking bus 1, device 40: "/sys/devices/pci0000:00/0000:00:14.0/usb1/1-2" Oct 16 21:04:30 localhost mtp-probe[23495]: bus: 1, device: 40 was not an MTP device Oct 16 21:04:30 localhost systemd-udevd[23497]: failed to execute '/usr/lib/udev/udev-acl' 'udev-acl --action=add --device=/dev/bus/usb/001/040': No such file or directory Oct 16 21:04:30 localhost systemd-udevd[23498]: failed to execute '/usr/lib/udev/udev-acl' 'udev-acl --action=add --device=': No such file or directory Oct 16 21:04:30 localhost systemd-udevd[23499]: failed to execute '/usr/lib/udev/udev-acl' 'udev-acl --action=add --device=': No such file or directory Oct 16 21:04:30 localhost systemd-udevd[23500]: failed to execute '/usr/lib/udev/udev-acl' 'udev-acl --action=add --device=': No such file or directory It worked last week :-) I filed the bug against ykpers since that module owns /usr/lib/udev/rules.d/70-yubikey.rules but it may belong somewhere else.
Has anything related been updated in the last week? You should be able to look at /var/log/dnf.rpm.log for packages... related might be ykpers, systemd*, kernel , *mtp*
Wrt comment:1 I didn't know about that log. Yes, it looks like fc22 went ykpers-1.17.1-1.fc22.x86_64 => ykpers-1.17.2-2.fc22.x86_64. Reverting to ykpers-1.17.1-1 fixes the problem.
ok. I think I see what the issue is, but not why it's happening yet. ;( Thanks for the bug report and will try and have a fixed package to test soon...
I just ran into this. sudo dnf downgrade ykpers solved the issue for me too. Looks like the rule is trying to run udev-acl but that doesn't exist. $ sudo dnf provides */udev-acl Last metadata expiration check performed 1:54:57 ago on Sat Oct 17 17:09:38 2015. Error: No Matches found This other bug report makes reference to udev-acl https://bugzilla.redhat.com/show_bug.cgi?id=859244 "udev release 182 the udev-acl tool is no longer being provided which breaks your test there and is affecting F17+ and any other distro that ships udev 182 or newer" Back to the downgrade, the reason why that works it seems is that ykpers-1.17.1-1.fc22.x86_64 had different pretty different udev rules It provided /lib/udev/rules.d/69-yubikey.rules ACTION!="add|change", GOTO="yubico_end" # Udev rules for letting the console user access the Yubikey USB # device node, needed for challenge/response to work correctly. # Yubico Yubikey II ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0010|0110|0111|0114|0116|0401|0403|0405|0407|0410", \ ENV{ID_SECURITY_TOKEN}="1" LABEL="yubico_end" vs /lib/udev/rules.d/70-yubikey.rules # Udev rules for letting the console user access the Yubikey USB # device node, needed for challenge/response to work correctly. ACTION=="add|change", SUBSYSTEM=="usb", \ ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0010|0110|0111|0114|0116|0401|0403|0405|0407|0410", \ TEST=="/var/run/ConsoleKit/database", \ RUN+="udev-acl --action=$env{ACTION} --device=$env{DEVNAME}" I'm not sure what one does that the other doesn't (besides not error out).
ykpers-1.17.2-3.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-091c0cf482
ykpers-1.17.2-3.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-7a02606fc1
ykpers-1.17.2-3.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-44760589e0
ykpers-1.17.2-3.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update ykpers' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-7a02606fc1
ykpers-1.17.2-3.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'yum --enablerepo=epel-testing update ykpers' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-091c0cf482
ykpers-1.17.2-3.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update ykpers' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-44760589e0
Yes the -3 fixes this bug. Thanks for the quick turn-around.
Just a note to anyone encountering the same problem: also, after upgrading ykpers as described in comment 10 you may need to reinsert the yubikey for the change to take effect. (At least that was my experience--presumably the change is to udev rules that are triggered on insert?)
ykpers-1.17.2-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
ykpers-1.17.2-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
ykpers-1.17.2-3.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.