# keyroost: udev rules granting unprivileged access to USB FIDO authenticators.
#
# Install with:
#   sudo cp udev/70-keyroost-fido.rules /etc/udev/rules.d/
#   sudo udevadm control --reload-rules
#   sudo udevadm trigger
#
# These rules are vendor-keyed rather than HID-usage-keyed so they apply at
# the USB layer before any /dev/hidraw* node is created — that lets tools
# enumerate and open the device without root. The TAG+="uaccess" form gives
# the currently-logged-in seat owner read/write access via systemd-logind
# instead of relying on group membership.

# Generic FIDO/U2F devices matched by HID usage page (0xF1D0) — works for any
# vendor as long as their report descriptor follows the spec. systemd-udevd's
# fido_id builtin (60-fido-id.rules, systemd v244+) sets ID_SECURITY_TOKEN=1
# from the usage page; matching on it (rather than bInterfaceClass=="03",
# which is *every* HID device) keeps keyboard/mouse hidraw nodes from
# becoming user-accessible — raw read access to a keyboard node is a
# keylogger.
#
# Caveat: on non-systemd udev (eudev — Alpine, Devuan, some Gentoo) fido_id
# never runs, so this generic rule matches nothing and only the explicit
# vendor rules below apply. Keys from other vendors on such systems need
# their own vendor-ID rule added here.
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
    ENV{ID_SECURITY_TOKEN}=="1", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"

# Yubico (YubiKey 4, 5, FIDO, Security Key, Bio)
SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"

# Feitian (ePass, BioPass, MultiPass)
SUBSYSTEM=="usb", ATTRS{idVendor}=="096e", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"

# SoloKeys Solo 1 (app + bootloader; 0483:a2ca is the Somu form factor)
SUBSYSTEM=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="a2ca", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"
SUBSYSTEM=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="5070", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"
SUBSYSTEM=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="50b0", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"

# SoloKeys Solo 2 — app mode (FIDO interface) and bootloader mode.
# Solo 2 does NOT share Solo 1's product IDs; verified against solo2-cli's
# own 70-solo2.rules. The bootloader rule lets management tools see a key
# that's been put into DFU, even though it won't speak FIDO there.
SUBSYSTEM=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="beee", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"
SUBSYSTEM=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="b000", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"

# Nitrokey (FIDO, FIDO2, Passkey, and Nitrokey 3 at 20a0:42b2 — the broad
# vendor match below already covers the Solo-2-derived Nitrokey 3 firmware)
SUBSYSTEM=="usb", ATTRS{idVendor}=="20a0", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"

# HyperFIDO
SUBSYSTEM=="usb", ATTRS{idVendor}=="2ccf", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"

# OnlyKey
SUBSYSTEM=="usb", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="60fc", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"

# Google Titan
SUBSYSTEM=="usb", ATTRS{idVendor}=="18d1", ATTRS{idProduct}=="5026", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"

# Token2 PIN+ / Release / FIDO2 variants
SUBSYSTEM=="usb", ATTRS{idVendor}=="349c", \
    TAG+="uaccess", GROUP="plugdev", MODE="0660"