Udev Rule Not Triggered

Udev Rule Not Triggered

[Antwane Mason]

I am trying to use my onlykey hardware based password manager with the
onlykey-cli but am unable to manipulate the device without root
permissions. After trying some debugging steps, I noticed that the udev
rule that I defined in my guix system config is not being triggered. Can
anyone spot anything wrong with my system configuration or is there
something else that I am missing?

Onlykey udev rule

*--8<---------------cut here---------------start------------->8---*

(define %onlykey-udev-rule
  (udev-rule
   "49-onlykey.rules"
   (string-append "ATTRS{idVendor}==\"1d50\", ATTRS{idProduct}==\"60fc\",
ENV{ID_MM_DEVICE_IGNORE}=\"1\""
                  "ATTRS{idVendor}==\"1d50\", ATTRS{idProduct}==\"60fc\",
ENV{MTP_NO_PROBE}=\"1\""
                  "SUBSYSTEMS==\"usb\", ATTRS{idVendor}==\"1d50\",
ATTRS{idProduct}==\"60fc\", MODE:=\"0666\""
                  "KERNEL==\"ttyACM*\", ATTRS{idVendor}==\"1d50\",
ATTRS{idProduct}==\"60fc\", MODE:=\"0666\""
                  ; Following is to automatically set current time for OTP
                  ; "SUBSYSTEMS==\"usb\", ATTRS{idVendor}==\"1d50\",
ATTRS{idProduct}==\"60fc\", MODE:=\"0660\", GROUP:=\"onlykey\",
RUN+=\"/usr/local/bin/onlykey-cli settime\""
                  ; "KERNEL==\"ttyACM*\", ATTRS{idVendor}==\"1d50\",
ATTRS{idProduct}==\"60fc\", MODE:=\"0660\", GROUP:=\"onlykey\",
RUN+=\"/usr/local/bin/onlykey-cli settime\""
                  )))

*--8<---------------cut here---------------end--------------->8---*


Included udev rule in services section of config

*--8<---------------cut here---------------start------------->8---*

(services (append (list (service gnome-desktop-service-type)
                          (service xfce-desktop-service-type)
                          (bluetooth-service #:auto-enable? #t)
                          (udev-rules-service 'onlykey-usb
%onlykey-udev-rule)
                          (set-xorg-configuration
                           (xorg-configuration
                            (keyboard-layout keyboard-layout))))
                    %desktop-services))



*--8<---------------cut here---------------end--------------->8---*

Udev debug info indicating that 49-onlykey.rules is not triggered.











































































*--8<---------------cut
here---------------start------------->8---antwane@wmguix /dev/usb$
sudo udevadm test $(udevadm info -q path -n /dev/bus/usb/001/009)
calling: testversion 3.2.9This program is for debugging only, it does
not run any programspecified by a RUN key. It may show incorrect
results, becausesome values may be different, or not available at a
simulation run.=== trie on-disk ===tool version:          3file size:
       8270736 bytesheader size             80 bytesstrings
2110312 bytesnodes              6160344 bytesLoad module
indextimestamp of
'/gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/etc/udev/rules.d'
changedReading rules file:
/gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/50-udev-default.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-block.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-cdrom_id.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-drm.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-evdev.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-input-id.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-persistent-alsa.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-persistent-input.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-persistent-storage-tape.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-persistent-storage.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-persistent-v4l.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-sensor.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/60-serial.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/64-btrfs.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/70-joystick.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/70-mouse.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/70-touchpad.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/75-net-description.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/75-probe_mtd.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/78-sound-card.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/80-drivers.rulesReading
rules file: /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/80-net-name-slot.rulesrules
contain 24576 bytes tokens (2048 * 12 bytes), 9493 bytes strings1086
strings (16592 bytes), 683 de-duplicated (7503 bytes), 404 trie nodes
usedIMPORT builtin 'usb_id'
/gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/50-udev-default.rules:13IMPORT
builtin 'hwdb' /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/50-udev-default.rules:13MODE
0664 /gnu/store/aza259fsrb841zwb4rjzfzs2nrsf28f1-eudev-3.2.9/lib/udev/rules.d/50-udev-default.rules:45handling
device node '/dev/bus/usb/001/009', devnum=c189:8, mode=0664, uid=0,
gid=0preserve permissions /dev/bus/usb/001/009, 020664, uid=0,
gid=0preserve already existing symlink '/dev/char/189:8' to
'../bus/usb/001/009'created db file '/run/udev/data/c189:8' for
'/devices/pci0000:00/0000:00:01.3/0000:03:00.0/usb1/1-3'ACTION=addBUSNUM=001DEVNAME=/dev/bus/usb/001/009DEVNUM=009DEVPATH=/devices/pci0000:00/0000:00:01.3/0000:03:00.0/usb1/1-3DEVTYPE=usb_deviceDRIVER=usbID_BUS=usbID_MODEL=ONLYKEYID_MODEL_ENC=ONLYKEYID_MODEL_FROM_DATABASE=OnlyKey
Two-factor Authentication and Password
SolutionID_MODEL_ID=60fcID_REVISION=0100ID_SERIAL=CRYPTOTRUST_ONLYKEY_1000000000ID_SERIAL_SHORT=1000000000ID_USB_INTERFACES=:030101:030000:ID_VENDOR=CRYPTOTRUSTID_VENDOR_ENC=CRYPTOTRUSTID_VENDOR_FROM_DATABASE=OpenMoko,
Inc.ID_VENDOR_ID=1d50MAJOR=189MINOR=8PRODUCT=1d50/60fc/100SUBSYSTEM=usbTYPE=0/0/0USEC_INITIALIZED=20491075910Unload
module index--8<---------------cut
here---------------end--------------->8---*



Regards,
Antwane

Re: Udev Rule Not Triggered

[pelzflorian (Florian Pelz)]

Hello Antwane!

I am not really familiar with udev rules, but perhaps this

On Sun, Aug 29, 2021 at 09:39:26AM -0400, Antwane Mason wrote:
> (define %onlykey-udev-rule
>   (udev-rule
>    "49-onlykey.rules"
>    (string-append "ATTRS{idVendor}==\"1d50\", ATTRS{idProduct}==\"60fc\",
> ENV{ID_MM_DEVICE_IGNORE}=\"1\""
>                   "ATTRS{idVendor}==\"1d50\", ATTRS{idProduct}==\"60fc\",
> ENV{MTP_NO_PROBE}=\"1\""


should use string-join instead of string-append

Regards,
Florian

Re: Udev Rule Not Triggered

[Antwane Mason]

> should use string-join instead of string-append

Thanks for the suggestion, but I know that use of string-append is correct
based on example code from
https://guix.gnu.org/manual/en/html_node/Base-Services.html.

(define %example-udev-rule
  (udev-rule <https://guix.gnu.org/manual/en/html_node/Base-Services.html#index-udev_002drule>
    "90-usb-thing.rules"
    (string-append
<https://www.gnu.org/software/guile/manual/html_node/Reversing-and-Appending-Strings.html#index-string_002dappend>
"ACTION==\"add\", SUBSYSTEM==\"usb\", "
                   "ATTR{product}==\"Example\", "
                   "RUN+=\"/path/to/script\"")))

Re: Udev Rule Not Triggered

[pelzflorian (Florian Pelz)]

On Sun, Aug 29, 2021 at 10:01:00AM -0400, Antwane Mason wrote:
> > should use string-join instead of string-append
> 
> Thanks for the suggestion, but I know that use of string-append is correct
> based on example code from
> https://guix.gnu.org/manual/en/html_node/Base-Services.html.
> […]
>     (string-append
> "ACTION==\"add\", SUBSYSTEM==\"usb\", "
>                    "ATTR{product}==\"Example\", "
>                    "RUN+=\"/path/to/script\"")))

The difference is that the manual uses spaces at the end of each
string except the last.

You can use string-append instead of string-join, but then you need a
space at the end of the strings.

Regards,
Florian

Re: Udev Rule Not Triggered

[pelzflorian (Florian Pelz)]

On Sun, Aug 29, 2021 at 04:28:08PM +0200, pelzflorian (Florian Pelz) wrote:
> >     (string-append
> > "ACTION==\"add\", SUBSYSTEM==\"usb\", "
> >                    "ATTR{product}==\"Example\", "
> >                    "RUN+=\"/path/to/script\"")))
> 
> The difference is that the manual uses spaces at the end of each
> string except the last.
> 
> You can use string-append instead of string-join, but then you need a
> space at the end of the strings.

P.S. Or for testing just use one big one-line string instead:

(define %onlykey-udev-rule
  (udev-rule
   "49-onlykey.rules"
   "ATTRS{idVendor}==\"1d50\", ATTRS{idProduct}==\"60fc\", ENV{ID_MM_DEVICE_IGNORE}=\"1\" ATTRS{idVendor}==\"1d50\", ATTRS{idProduct}==\"60fc\", […]"
   ))

You can also use newlines in the string if syntax requires it.

Regards,
Florian

Re: Udev Rule Not Triggered

[Antwane Mason]

Thanks for the clarification. I changed the code to use string-join.
However, the rule is still not running after doing a system reconfigure and
restarting computer. Does anyone know the environment variables that
control finding udev rules? I'm wondering if there is a problem there.

Regards,
Antwane


On Sun, Aug 29, 2021 at 10:42 AM pelzflorian (Florian Pelz) <
pelzflorian@pelzflorian.de> wrote:

> On Sun, Aug 29, 2021 at 04:28:08PM +0200, pelzflorian (Florian Pelz) wrote:
> > >     (string-append
> > > "ACTION==\"add\", SUBSYSTEM==\"usb\", "
> > >                    "ATTR{product}==\"Example\", "
> > >                    "RUN+=\"/path/to/script\"")))
> >
> > The difference is that the manual uses spaces at the end of each
> > string except the last.
> >
> > You can use string-append instead of string-join, but then you need a
> > space at the end of the strings.
>
> P.S. Or for testing just use one big one-line string instead:
>
> (define %onlykey-udev-rule
>   (udev-rule
>    "49-onlykey.rules"
>    "ATTRS{idVendor}==\"1d50\", ATTRS{idProduct}==\"60fc\",
> ENV{ID_MM_DEVICE_IGNORE}=\"1\" ATTRS{idVendor}==\"1d50\",
> ATTRS{idProduct}==\"60fc\", […]"
>    ))
>
> You can also use newlines in the string if syntax requires it.
>
> Regards,
> Florian
>

Re: Udev Rule Not Triggered

[Antwane Mason]

I was able to at least confirm that the rule exists on the system despite
not being run. I used "sudo herd rules udev" to find the store path where
udev rules were and confirmed that 49-onlykey.rules is in lib/udev/rules.d.
Still can't figure out why it's not running though.

Re: Udev Rule Not Triggered

[pelzflorian (Florian Pelz)]

On Sun, Aug 29, 2021 at 11:44:50AM -0400, Antwane Mason wrote:
> I was able to at least confirm that the rule exists on the system despite
> not being run. I used "sudo herd rules udev" to find the store path where
> udev rules were and confirmed that 49-onlykey.rules is in lib/udev/rules.d.
> Still can't figure out why it's not running though.

Does

less $(sudo herd rules udev)/lib/udev/rules.d/49-onlykey.rules

show the same rules as what is described in your documentation (maybe
https://docs.crp.to/linux.html)?

Regards,
Florian

Re: Udev Rule Not Triggered

[Antwane Mason]

On Sun, Aug 29, 2021 at 1:23 PM pelzflorian (Florian Pelz) <
pelzflorian@pelzflorian.de> wrote:

> On Sun, Aug 29, 2021 at 11:44:50AM -0400, Antwane Mason wrote:
> > I was able to at least confirm that the rule exists on the system despite
> > not being run. I used "sudo herd rules udev" to find the store path where
> > udev rules were and confirmed that 49-onlykey.rules is in
> lib/udev/rules.d.
> > Still can't figure out why it's not running though.
>
> Does
>
> less $(sudo herd rules udev)/lib/udev/rules.d/49-onlykey.rules
>

> show the same rules as what is described in your documentation (maybe
> https://docs.crp.to/linux.html)?
>
> It appears so but to be completely safe, I pulled in the original rules
file directly.

*--8<---------------cut
here---------------start------------->8---
(define %onlykey-udev-rule
  (file->udev-rule
    "49-onlykey.rules"
    (let ((version "v1.2.5"))
      (origin
       (method url-fetch)
       (uri
"https://raw.githubusercontent.com/M0Rf30/https://raw.githubusercontent.com/trustcrypto/trustcrypto.github.io/master/49-onlykey.rules")
       (sha256
        (base32 "1pj9i4hp0d74073x1qqwigd0cyriamg65zmx2j98mi0k66qrhcxa"))))))
--8<---------------cut
here---------------end--------------->8---*

 I also tried the following to see if setting the environment variable
helps but onlykey-cli still not working without using sudo.

UDEV_CONF_FILE=/gnu/store/7yncwxmnpcg5p4273xzmsc6axydfwm1v-udev-rules/lib/udev/rules.d
sudo udevadm test $(udevadm info -q path -n /dev/bus/usb/001/005)

Re: Udev Rule Not Triggered

[Antwane Mason]

I'm honestly not sure what fixed the issue, but I am successfully able to
use the onlykey-cli without root privileges. I suspect the issue was my
method of testing whether a udev rule was being triggered actually was
interfering with it working. I used "udevadm test" and noticed two things.
First, was even when I was able to run onlykey-cli without root privileges,
running the test command did not show that the udev rule was triggered.
Second, each time the test command was performed, I had to restart the
computer before onlykey-cli would work again.

In addition to "udevadm test" being a potential cause of my issues, it is
unclear whether my system config changes also contributed to the solution.
Instead of creating a standalone udev rule service as I had originally,
I adapted the config from
https://lists.gnu.org/archive/html/help-guix/2018-05/msg00159.html and
modified the udev service type to include the udev rules for the onlykey. I
also imported the rules directly from github rather than manually
transcribing the rule as before.

I'm going to call it a day and try to do some exploration another day to
figure out the root cause. For now, I just wanted to say thank you,
Florian, for your help today. I hope this information can save someone else
some headaches in the future. If I find out the root cause, I'll be sure to
follow up here as well.

onlykey udev rule definition and extension of udev service type

--8<---------------cut here---------------start------------->8---
(define %onlykey-udev-rule
  (file->udev-rule
    "49-onlykey.rules"
    (let ((version "v1.2.5"))
      (origin
       (method url-fetch)
       (uri
"https://raw.githubusercontent.com/M0Rf30/https://raw.githubusercontent.com/trustcrypto/trustcrypto.github.io/master/49-onlykey.rules")
       (sha256
        (base32 "1pj9i4hp0d74073x1qqwigd0cyriamg65zmx2j98mi0k66qrhcxa"))))))

(define %my-services
  (modify-services %desktop-services
                   (udev-service-type config =>
                                      (udev-configuration
                                       (inherit config)
                                       (rules (append
                                               (udev-configuration-rules config)
                                               (list %onlykey-udev-rule)))))))
--8<---------------cut here---------------end--------------->8---

service field definition

--8<---------------cut here---------------start------------->8---
(services (append (list (service gnome-desktop-service-type)
                          (service xfce-desktop-service-type)
                          (bluetooth-service #:auto-enable? #t)
                          (set-xorg-configuration
                           (xorg-configuration
                            (keyboard-layout keyboard-layout))))
                    %my-services))
--8<---------------cut here---------------end--------------->8---

Regards,
Antwane

Re: Udev Rule Not Triggered

[pelzflorian (Florian Pelz)]

Glad you got it to work.  From the udev man page I don’t understand
how a udev rule that only sets the MODE could break, it is puzzling.

On Sun, Aug 29, 2021 at 05:39:13PM -0400, Antwane Mason wrote:
> I hope this information can save someone else
> some headaches in the future.

Thank you for describing so thoroughly.

Regards,
Florian

Re: Udev Rule Not Triggered

[Tobias Geerinckx-Rice]

Antwane,

Great that you got it to work!  There are some landmines left that I'd 
like to point out so they don't bite you later (what? they're 
mixed-metaphor cartoon landmines!):

On 2021-08-29 16:01, Antwane Mason wrote:
>> should use string-join instead of string-append
> 
> Thanks for the suggestion, but I know that use of string-append is 
> correct
> based on example code from
> https://guix.gnu.org/manual/en/html_node/Base-Services.html.

Yes, but *your* use of it isn't. :-)  You didn't add any newlines so 
everything ends up on one line, which can't work [well].

> (uri
> "https://raw.githubusercontent.com/M0Rf30/https://raw.githubusercontent.com/trustcrypto/trustcrypto.github.io/master/49-onlykey.rules")
>       (sha256
>        (base32 "1pj9i4hp0d74073x1qqwigd0cyriamg65zmx2j98mi0k66qrhcxa"))

This URL is bogus?  It probably works for {you,now} because Guix is 
content-addressed and you've previously downloaded a file with that hash 
to your store.  If it ever gets garbage collected, Guix will be unable 
to download again.

I advise against using an external file for such a trivial rule at all, 
and simply fixing the string-append until it works (and the actual file 
contents look correct).

Kind regards,

T G-R

Sent from a Web browser.  Excuse or enjoy my brevity.

Re: Udev Rule Not Triggered

[Antwane Mason]

Thanks Tobias for pointing out those problems! That should help in getting
to the root of what the problem originally was.
On Sun, Aug 29, 2021 at 6:17 PM Tobias Geerinckx-Rice <me@tobias.gr> wrote:

> Antwane,
>
> Great that you got it to work!  There are some landmines left that I'd
> like to point out so they don't bite you later (what? they're
> mixed-metaphor cartoon landmines!):
>
> On 2021-08-29 16:01, Antwane Mason wrote:
> >> should use string-join instead of string-append
> >
> > Thanks for the suggestion, but I know that use of string-append is
> > correct
> > based on example code from
> > https://guix.gnu.org/manual/en/html_node/Base-Services.html.
>
> Yes, but *your* use of it isn't. :-)  You didn't add any newlines so
> everything ends up on one line, which can't work [well].
>
> > (uri
> > "
> https://raw.githubusercontent.com/M0Rf30/https://raw.githubusercontent.com/trustcrypto/trustcrypto.github.io/master/49-onlykey.rules
> ")
> >       (sha256
> >        (base32 "1pj9i4hp0d74073x1qqwigd0cyriamg65zmx2j98mi0k66qrhcxa"))
>
> This URL is bogus?  It probably works for {you,now} because Guix is
> content-addressed and you've previously downloaded a file with that hash
> to your store.  If it ever gets garbage collected, Guix will be unable
> to download again.
>
> I advise against using an external file for such a trivial rule at all,
> and simply fixing the string-append until it works (and the actual file
> contents look correct).
>
> Kind regards,
>
> T G-R
>
> Sent from a Web browser.  Excuse or enjoy my brevity.
>
-- 

Regards,
Antwane