U2F not working in Snap distribution #6782
Comments
|
It seems to be quite easy fix - Brave |
|
Then there are two options: either leave it with the |
|
cc: @mbacchi can you take a look at this one? |
rebron
added
the
priority/P3
|
We added a couple of dependencies to the Snap package in brave/brave-browser-snap#14. Is this still broken? |
|
hello, still not working with : |
|
CCing @jumde |
|
broken for me in Version 1.20.103 Chromium: 88.0.4324.152 (Official Build) (64-bit), u2f-devices manually connected [45549.431256] audit: type=1400 audit(1613949356.379:640): apparmor="DENIED" operation="open" profile="snap.brave.brave" name="/run/udev/data/c510:8" pid=524776 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 |
|
this seems like it could be a higher priority given the crypto focus of the browser, can we possibly bounty this? it doesn't seem like it should be super hard, I am not familiar enough w snaps/apparmor to say for sure but someone with relevant experience probably could |
|
@parkan can you upgrade to the latest snap package version? I tested this today on Arch. Right after installation AppArmor was indeed blocking access and after running What does |
I think my udev rules are in order, as well: |
|
@parkan on my system, the udev rules for each snap package are generated and written to /etc/udev/rules.d/70-snap.brave.rulesThe rule relevant to your device (Ledger Nano X) looks as follows: That differs from what you shared. Notably the SUBSYSTEM is There is also a rule to invoke the snap-device-helper based on the snap_brave_brave tag: Are udev rules not generated on your system? Those should be sufficient to make your device work, you should not have to write udev rules manually. If you don't see any files matching |
|
I got those rules from the ledger FAQ, in the snap specific file I have: |
|
@parkan alright, let's try a few things:
Regarding the last point - I noticed my yubikey only works if I plug it in after the Brave snap is started. This is also the behavior of the Chromium snap, but not the Firefox snap. That's something to look into, but for now, let's just get this working for you and we can make further improvements later. Also, what OS are you on ( |
👍
it does not work with FF snap (u2f-devices connected) it does work with ledger live AppImage
see the hid-generic hid-generic lines in the log above, this is how I am trying it
|
|
@parkan can you try these steps https://support.ledger.com/hc/en-us/articles/115005165269-Fix-connection-issues, followed by Also, can you try a different u2f device with the Brave/Chromium/Firefox snaps? Like a Yubikey? |
tried those steps before coming here, that's where the other rules are from 🙂 will try raw usb as well as a yubikey |
|
also fwiw I did a ppa install and that works fine, so I may just switch to that browser (a bit tricky b/c sync doesn't seem to do anything and I have a lot of state in this browser) but happy to keep debugging if it's helpful for you |
|
Hey @parkan. Have you had the chance to try raw-usb and the Yubikey? |
raw-usb didn't help, yubikey still not on hand (in my storage unit) at this point I basically believe that snaps, unless very specifically and heavily maintained, are not usable for complex consumer apps (dpi scaling, sync, printing are all broken, startup takes 20x native app, snapd eats a ton of resources and slows down boot, apps claim 30GiB vmem, app crashes randomly, extensions get corrupted, etc etc) thank you for patiently debugging this with me! however, I think the immediate solution is to only recommend ppa installs (or remove the snap altogether) in ppa install everything works fine |
|
that being said, as apparmor becomes more common (and as weyland matures) it's something that will need to get ironed out -- I sorta feel like the bulk of work is on chromium |
|
@parkan since the Ledger device doesn't work with the Firefox snap either, there isn't much that we can do. We rely on the But I would definitely encourage you to report this to Ledger (site, github, reddit) and the Snap store (forum). As for the original problem this issue was covering - we were granted auto-connection for the |
|
@wknapik agreed! |
|
After the new snap package release a few minutes ago, the This change will kick in automatically on all systems, as This confirms that it's no longer necessary to run However, the device needs to be (re)connected after the Brave snap is started. This also affects the Chromium snap, but not the Firefox snap. Will track this in this issue. |
|
Created #15003 for the remaining issue of having to (re)connect the u2f device after the snap starts. Closing. |
Related issues, both closed now:
Description
U2F key is not seen by Brave and it eventually times out offering fallback to TOTP. Journalctl displays these logs, which implies the Snap is missing plugs allowing it to access the U2F device:
Steps to Reproduce
Actual result:
U2F key is not seen by Brave and it eventually times out offering fallback to TOTP. Journalctl displays these logs, which implies the Snap is missing plugs allowing it to access the U2F device:
Expected result:
U2F is detected by Brave
Reproduces how often:
Always
Brave version (brave://version info)
Version/Channel Information:
Other Additional Information:
Miscellaneous Information:
Thread on Snapcraft forum https://forum.snapcraft.io/t/u2f-not-working-in-firefox-snap/14039
The text was updated successfully, but these errors were encountered: