At least I found a clue myself, it is SELinux denying access: type=AVC msg=audit(25-11-19 17:14:33.367:689) : avc: denied { read } for pid=48804 comm=login name=u2f_keys dev="dm-4" ino=28953 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=file permissive=0 ---- type=AVC msg=audit(25-11-19 17:16:56.497:728) : avc: denied { read } for pid=49470 comm=login name=u2f_keys dev="dm-4" ino=28953 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=file permissive=0 I was able to make it work by using: semenage fcontext -a -f a -t auth_home_t -r 's0' '/home(/.*)/.config/Yubico/u2f_keys' semanage fcontext -a -f a -t auth_home_t -r 's0' '/root/.config/Yubico/u2f_keys' Nevertheless, it feels more like "feature" in the SELinux policy. Anyone familiar with this? Winfried -----Oorspronkelijk bericht----- Van: Winfried de Heiden <wdh@xxxxxx> Antwoord-naar: Community support for Fedora users <users@xxxxxxxxxxxxxxxxxxxxxxx> Aan: Community support for Fedora users <users@xxxxxxxxxxxxxxxxxxxxxxx> Onderwerp: Fedora 31 - pam_u2f - Yubikey 5 Datum: Mon, 25 Nov 2019 16:44:15 +0100 Hi all, Using Fedora 31, pam_u2f and a Yubikey5 works well after: authselect select sssd with-mkhomedir with-pam-u2f with-sudo without-nullok and pamu2fcfg –u[username] > ~/.config/Yubico/u2f_keys However, from the console (without GDM, multi-user.target for example) it does not work: Linux will ask for my password where the yubikey should be sufficient. Any ideas what could be wrong? Winfried
_______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx |
_______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
