Skip to content

feat(yubikey): lock on unplug only if FIDO2 enrolled#1810

Merged
brianmcgillion merged 1 commit intotiiuae:mainfrom
vunnyso:vs-fixYubi
Mar 10, 2026
Merged

feat(yubikey): lock on unplug only if FIDO2 enrolled#1810
brianmcgillion merged 1 commit intotiiuae:mainfrom
vunnyso:vs-fixYubi

Conversation

@vunnyso
Copy link
Copy Markdown
Collaborator

@vunnyso vunnyso commented Mar 9, 2026 •
edited
Loading

Description of Changes

Add enrollment-aware YubiKey removal locking by syncing a FIDO2 state marker from systemd-homed.

Sessions are locked only when a user has FIDO2/YubiKey enrollment, preventing unintended laptop locks when a YubiKey is unplugged but no user is enrolled.

Fixes: https://jira.tii.ae/browse/SSRCSP-7990

Type of Change

  • New Feature
  • Bug Fix
  • Improvement / Refactor

Related Issues / Tickets

Checklist

  • Clear summary in PR description
  • Detailed and meaningful commit message(s)
  • Commits are logically organized and squashed if appropriate
  • Contribution guidelines followed
  • Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
  • Author has run make-checks and it passes
  • All automatic GitHub Action checks pass - see actions
  • Author has added reviewers and removed PR draft status

Testing Instructions

Applicable Targets

  • Orin AGX aarch64
  • Orin NX aarch64
  • Lenovo X1 x86_64
  • Dell Latitude x86_64
  • System 76 x86_64

Installation Method

  • Requires full re-installation
  • Can be updated with nixos-rebuild ... switch
  • Other:

Test Steps To Verify:

  1. https://jira.tii.ae/browse/SSRCSP-7990 issue is fixed.
  2. To test PR, make sure existing user is removed first 
    [ghaf@gui-vm:~]$ sudo homectl remove <user-name>

slakkala
slakkala approved these changes Mar 9, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@slakkala slakkala left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The concept seems legit, added some comments but nothing blocking.

@vunnyso
feat(yubikey): lock on unplug only if FIDO2 enrolled
eb53495 
Add enrollment-aware YubiKey removal locking by syncing a
FIDO2 state marker from systemd-homed.

Sessions are locked only when a user has FIDO2/YubiKey
enrollment, preventing unintended laptop locks when a
YubiKey is unplugged but no user is enrolled.

Signed-off-by: Vunny Sodhi <vunny.sodhi@unikie.com>
@milva-unikie
Copy link
Copy Markdown

milva-unikie commented Mar 10, 2026

Tested on Darter Pro

Without FIDO2 enrollment:

  • Bug has been fixed, system is not locked when Yubikey is removed

With FIDO2 enrollment:

  • Yubikey works for login and unlocking
  • System is locked when Yubikey is removed

@brianmcgillion brianmcgillion merged commit e69f262 into tiiuae:main Mar 10, 2026
32 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@brianmcgillion brianmcgillion brianmcgillion approved these changes

@mbssrc mbssrc Awaiting requested review from mbssrc

@kajusnau kajusnau Awaiting requested review from kajusnau

+1 more reviewer

@slakkala slakkala slakkala approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

Tested on System76

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@vunnyso @milva-unikie @brianmcgillion @slakkala