U2F not working in Snap distribution

Related issues, both closed now:

• #1007 was about Snap package for Brave
• #3558 describes similar issue in non-Snap package

Description

U2F key is not seen by Brave and it eventually times out offering fallback to TOTP. Journalctl displays these logs, which implies the Snap is missing plugs allowing it to access the U2F device:

Steps to Reproduce

1. snap install --beta brave
2. Try to login to an U2F-enabled website (Bitbucket in my case)

Actual result:

U2F key is not seen by Brave and it eventually times out offering fallback to TOTP. Journalctl displays these logs, which implies the Snap is missing plugs allowing it to access the U2F device:

Nov 06 14:26:17 pax kernel: usb 1-2: new full-speed USB device number 24 using xhci_hcd
Nov 06 14:26:17 pax kernel: usb 1-2: New USB device found, idVendor=1050, idProduct=0120, bcdDevice= 5.02
Nov 06 14:26:17 pax kernel: usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
Nov 06 14:26:17 pax kernel: usb 1-2: Product: Security Key by Yubico
Nov 06 14:26:17 pax kernel: usb 1-2: Manufacturer: Yubico
Nov 06 14:26:17 pax kernel: hid-generic 0003:1050:0120.0008: hiddev1,hidraw2: USB HID v1.10 Device [Yubico Security Key by Yubico] on usb-0000:00:14.0-2/input0
Nov 06 14:26:17 pax mtp-probe[5973]: checking bus 1, device 24: "/sys/devices/pci0000:00/0000:00:14.0/usb1/1-2"
Nov 06 14:26:17 pax mtp-probe[5973]: bus: 1, device: 24 was not an MTP device
Nov 06 14:26:17 pax audit[5028]: AVC apparmor="DENIED" operation="open" profile="snap.brave.brave" name="/sys/devices/pci0000:00/0000:00:14.0/usb1/1-2/busnum" pid=5028 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Nov 06 14:26:17 pax audit[5028]: AVC apparmor="DENIED" operation="open" profile="snap.brave.brave" name="/sys/devices/pci0000:00/0000:00:14.0/usb1/1-2/devnum" pid=5028 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Nov 06 14:26:17 pax audit[5028]: AVC apparmor="DENIED" operation="open" profile="snap.brave.brave" name="/sys/devices/pci0000:00/0000:00:14.0/usb1/1-2/1-2:1.0/0003:1050:0120.0008/report_descriptor" pid=5028 comm="ThreadPoolForeg" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
Nov 06 14:26:17 pax mtp-probe[5983]: checking bus 1, device 24: "/sys/devices/pci0000:00/0000:00:14.0/usb1/1-2"

Expected result:

U2F is detected by Brave

Reproduces how often:

Always

Brave version (brave://version info)

Brave | 0.69.135 Chromium: 77.0.3865.120 (Official Build) (64-bit)
-- | --
Revision | 416d6d8013e9adb6dd33b0c12e7614ff403d1a94-refs/branch-heads/3865@{#884}
OS | Linux
JavaScript | V8 7.7.299.13
Flash | (Disabled)
User Agent | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36
Command Line | /snap/brave/61/opt/brave.com/brave/brave-browser --enable-dom-distiller --disable-domain-reliability --disable-chrome-google-url-tracking-client --no-pings --extension-content-verification=enforce_strict --extensions-install-verification=enforce --enable-features=NewExtensionUpdaterService,WebUIDarkMode,SimplifyHttpsIndicator --disable-features=AudioServiceOutOfProcess,AutofillServerCommunication,LookalikeUrlNavigationSuggestionsUI,UnifiedConsent --flag-switches-begin --flag-switches-end
Executable Path | /snap/brave/61/opt/brave.com/brave/brave-browser
Profile Path | /home/kravietz/snap/brave/61/.config/BraveSoftware/Brave-Browser/Default

Version/Channel Information:

$ snap list brave
Name   Version   Rev  Tracking  Publisher  Notes
brave  0.69.135  61   beta      brave      -

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? NO
• Does the issue resolve itself when disabling Brave Rewards? NO

Miscellaneous Information:

Thread on Snapcraft forum https://forum.snapcraft.io/t/u2f-not-working-in-firefox-snap/14039

[fmarier]

We added a couple of dependencies to the Snap package in https://github.com/brave/brave-browser-snap/pull/14.

Is this still broken?

[parkan]

this seems like it could be a higher priority given the crypto focus of the browser, can we possibly bounty this? it doesn’t seem like it should be super hard, I am not familiar enough w snaps/apparmor to say for sure but someone with relevant experience probably could