[snap] Nitrokey FIDO2 does not work with Chromium snap

[Kevin Keijzer]

I have a Nitrokey FIDO2, which works fine with the Firefox deb package. However, it does not work at all with the Chromium snap. I have libu2f-udev installed.

This problem can be fixed by adding the following lines to /etc/udev/rules.d/70-snap.chromium.rules:

# u2f-devices
# Nitrokey FIDO2
SUBSYSTEM=="hidraw", KERNEL=="hidraw*", ATTRS{idVendor}=="20a0", ATTRS{idProduct}=="42b1", TAG+="snap_chromium_chromium"
TAG=="snap_chromium_chromium", RUN+="/usr/lib/snapd/snap-device-helper $env{ACTION} snap_chromium_chromium $devpath $major:$minor"

and then running sudo udevadm control --reload-rules && sudo udevadm trigger.

After that, it works perfectly well.

The Yubico YubiKey is already present with a very similar line, so this is merely a case of a missing rule.

It would be very nice if support for the Nitrokey FIDO2 could be upstreamed.

More background here: https://support.nitrokey.com/t/nitrokey-fido2-funktioniert-nicht-mit-firefox-und-chromium-unter-ubuntu-20-04/2651

Also hereby the required fluff:

kevin@vanadium:~$ lsb_release -rd
Description: Ubuntu 20.04.2 LTS
Release: 20.04

kevin@vanadium:~$ snap info chromium
name: chromium
summary: Chromium web browser, open-source version of Chrome
publisher: Canonical✓
store-url: https://snapcraft.io/chromium
contact: https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bugs?field.tag=snap
license: unset
description: |
  An open-source browser project that aims to build a safer, faster, and more stable way for all
  Internet users to experience the web.
commands:
  - chromium.chromedriver
  - chromium
snap-id: XKEcBqPM06H1Z7zGOdG5fbICuf8NWK5R
tracking: latest/stable
refresh-date: today at 08:05 CEST
channels:
  latest/stable: 92.0.4515.159 2021-08-17 (1708) 148MB -
  latest/candidate: 92.0.4515.159 2021-08-17 (1708) 148MB -
  latest/beta: 93.0.4577.42 2021-08-13 (1699) 149MB -
  latest/edge: 94.0.4603.0 2021-08-14 (1700) 153MB -
installed: 92.0.4515.159 (1708) 148MB -

What I expected to happen: My FIDO2 security key should work.

What happened instead: It didn't work, due to a missing udev rule.

[Ian Johnson (anonymouse67)]

This is because snapd's u2f-devices interface lacks this rule. See my response here: https://forum.snapcraft.io/t/nitrokey-fido2-does-not-work-with-chromium-snap/26098/2

[Kevin Keijzer (kkeijzer)]

Related pull request here: https://github.com/snapcore/snapd/pull/10642