Comment 9 for bug 1741768

That does imply AppArmor is the issue with that denial; `authenticator-rs` requires hidraw access to the relevant devices. https://github.com/amluto/u2f-hidraw-policy is the package used by other linuxes, I don't know the equivalent for Debian.