At least I found a clue myself, it is SELinux denying access:
type=AVC msg=audit(25-11-19 17:14:33.367:689) : avc: denied { read }
for pid=48804 comm=login name=u2f_keys dev="dm-4" ino=28953
scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:config_home_t:s0 tclass=file
permissive=0
----
type=AVC msg=audit(25-11-19 17:16:56.497:728) : avc: denied { read }
for pid=49470 comm=login name=u2f_keys dev="dm-4" ino=28953
scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:config_home_t:s0 tclass=file
permissive=0
I was able to make it work by using:
semenage fcontext -a -f a -t auth_home_t -r 's0'
'/home(/.*)/.config/Yubico/u2f_keys'
semanage fcontext -a -f a -t auth_home_t -r 's0'
'/root/.config/Yubico/u2f_keys'
Nevertheless, it feels more like "feature" in the SELinux policy.
Anyone familiar with this?
Winfried
-----Oorspronkelijk bericht-----
Van: Winfried de Heiden <wdh(a)dds.nl>
Antwoord-naar: Community support for Fedora users <
users(a)lists.fedoraproject.org>
Aan: Community support for Fedora users <users(a)lists.fedoraproject.org>
Onderwerp: Fedora 31 - pam_u2f - Yubikey 5
Datum: Mon, 25 Nov 2019 16:44:15 +0100
Hi all,
Using Fedora 31, pam_u2f and a Yubikey5 works well after:
authselect select sssd with-mkhomedir with-pam-u2f with-sudo without-
nullok
and
pamu2fcfg –u[username] > ~/.config/Yubico/u2f_keys
However, from the console (without GDM, multi-user.target for example)
it does not work: Linux will ask for my password where the yubikey
should be sufficient.
Any ideas what could be wrong?
Winfried
_______________________________________________users mailing list --
users(a)lists.fedoraproject.org
To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org