Skip to content

Instantly share code, notes, and snippets.

@alexmurray
Last active March 6, 2020 06:05
Show Gist options
  • Save alexmurray/d21d6469d842c440630b746d72f6d7e4 to your computer and use it in GitHub Desktop.
Save alexmurray/d21d6469d842c440630b746d72f6d7e4 to your computer and use it in GitHub Desktop.
diff --git a/interfaces/builtin/u2f_devices.go b/interfaces/builtin/u2f_devices.go
index 8413c94b2..7a702051f 100644
--- a/interfaces/builtin/u2f_devices.go
+++ b/interfaces/builtin/u2f_devices.go
@@ -121,6 +121,9 @@ var u2fDevices = []u2fDevice{
const u2fDevicesConnectedPlugAppArmor = `
# Description: Allow write access to u2f hidraw devices.
+# Allow to access all usb devices and rely on the device cgroup for mediation.
+/dev/bus/usb/[0-9][0-9][0-9]/[0-9][0-9][0-9] rw,
+
# Use a glob rule and rely on device cgroup for mediation.
/dev/hidraw* rw,
@@ -143,6 +146,7 @@ type u2fDevicesInterface struct {
func (iface *u2fDevicesInterface) UDevConnectedPlug(spec *udev.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
for _, d := range u2fDevices {
spec.TagDevice(fmt.Sprintf("# %s\nSUBSYSTEM==\"hidraw\", KERNEL==\"hidraw*\", ATTRS{idVendor}==\"%s\", ATTRS{idProduct}==\"%s\"", d.Name, d.VendorIDPattern, d.ProductIDPattern))
+ spec.TagDevice(fmt.Sprintf("SUBSYSTEM==\"usb\", ATTRS{idVendor}==\"%s\", ATTRS{idProduct}==\"%s\"", d.VendorIDPattern, d.ProductIDPattern))
}
return nil
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment