Bug Description

The program fails to load on Fedora (or other distros with SELinux[^1] in enforcement mode). It fails silently with the following[^2] message:

fedora system-daemon[133194]: frame decoded from buffer
fedora system-daemon[133194]: Running getpwuid_r for user #1000
fedora system-daemon[133194]: Loading user with uid 1000
fedora system-daemon[133194]: Creating UHID virtual U2F device
fedora system-daemon[133194]: Relaying create device response, success:false
fedora system-daemon[133194]: Creating UHID device failed: I/O error: Permission denied (os error 13)
fedora system-daemon[133194]: flushing framed transport
fedora system-daemon[133194]: writing;
fedora system-daemon[133194]: framed transport flushed
fedora system-daemon[133194]: Spawned handler finished with: Err(Io(Os { code: 13, kind: PermissionDenied, message: "Permission denied" }))

Further details

I was building the repository from source using the included Makefile, according to the directions in the README.
- I had some trouble installing the package using the instructions in the README. I kept getting stuff along the lines of:
```
pygpgme couold not be installed. This means GPG verification is not possible for any RPM installed on your system... etc.
```
- This seems to be an issue with other repositories that use PackageCloud.
- I uninstalled this before continuing.
It didn't work when I first started testing, I kept getting the error above in the logs.

SELinux Workaround

Uninstall rust-u2f with the Makefile. Make sure everything is as stock as possible.
Go to the linux directory in the project. Run make install. Then:
```
sudo ausearch -m avc -ts recent | audit2allow
```
Check the rule generated actually references uhid_devices. Mine looked like this:
```
allow init_t uhid_device_t:chr_file { open read write };
```

Apply the rule.

sudo ausearch -m avc -ts recent | audit2allow -M rust-softu2f
sudo semodule -i rust-softu2f.pp

Then, make uninstall && make install again, should work now. Verify by listing the SELinux policies and checking the output of journalctl as normal.

Environment

OS: Fedora 39 Kernel 6.5.6-300.fc39.x86_64
SELinux: Enforcing
Browser: Mozilla Firefox

Reproduction

Try to build the project following README instructions on Fedora 39 (SELinux in enforcing mode), testing with WebAuthn on Mozilla Firefox.

I don't know whether this is in scope or not, I'm mainly writing this for people trying to Google this issue. Maybe we could add something to the README or bundling some SELinux policies with the repo? Again, I'm not sure. Let me know if you want any more detail/logs/reproduction tips etc.

[^1]: When I tried to fix this for the first time (just modifying chmod), SELinux blocked my changes. [^2]: From journalctl -f -u softu2f

Update

After the computer is rebooted, everything stops working with a new error this time. Error 19?

Apr 18 08:42:19 fedora system-daemon[20055]: Starting rust-u2f system daemon Apr 18 08:42:19 fedora system-daemon[20055]: LISTEN_PID = Ok("20055"); LISTEN_FDS = Ok("1") Apr 18 08:42:19 fedora system-daemon[20055]: SocketServer: accepted stream Apr 18 08:42:19 fedora system-daemon[20055]: ConnectionHandler::call Apr 18 08:42:19 fedora system-daemon[20055]: SocketServer: Spawned handler for stream Apr 18 08:42:19 fedora system-daemon[20055]: Handler ready, waiting for it to complete Apr 18 08:42:19 fedora system-daemon[20055]: Handling connection Apr 18 08:42:19 fedora system-daemon[20055]: Ready to create UHID device Apr 18 08:42:19 fedora system-daemon[20055]: attempting to decode a frame Apr 18 08:42:19 fedora system-daemon[20055]: frame decoded from buffer Apr 18 08:42:19 fedora system-daemon[20055]: Running getpwuid_r for user #1000 Apr 18 08:42:19 fedora system-daemon[20055]: Loading user with uid 1000 Apr 18 08:42:19 fedora system-daemon[20055]: Creating UHID virtual U2F device Apr 18 08:42:19 fedora system-daemon[20055]: Relaying create device response, success:false Apr 18 08:42:19 fedora system-daemon[20055]: "Creating UHID device failed: I/O error: No such device (os error 19)" Apr 18 08:42:19 fedora system-daemon[20055]: flushing framed transport Apr 18 08:42:19 fedora system-daemon[20055]: writing; Apr 18 08:42:19 fedora system-daemon[20055]: framed transport flushed Apr 18 08:42:19 fedora system-daemon[20055]: thread 'tokio-runtime-worker' panicked at linux/system-daemon/src/socket_server.rs:73:33: Apr 18 08:42:19 fedora system-daemon[20055]: not yet implemented Apr 18 08:42:19 fedora system-daemon[20055]: note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace Apr 18 08:42:19 fedora system-daemon[20055]: Spawned handler finished with: Err(Io(Os { code: 19, kind: Uncategorized, message: "No such device" }))

Note: quotations added for emphasis

This is strange, /dev/uhid definitely does exist, so I've no clue what this could be. My other troubleshooting has come up completely empty, sadly.

g@fedora:~/Documents/Programming/rust-u2f/linux$ ls -l /dev/uhid crw-------. 1 root root 10, 239 Apr 18 06:41 /dev/uhid g@fedora:~/Documents/Programming/rust-u2f/linux$ dmesg | grep uhid g@fedora:~/Documents/Programming/rust-u2f/linux$ sudo ausearch -m avc -ts recent | grep uhid <no matches>

danstiner / rust-u2f