What would you like to improve?

I'd like to use a Mac-connected USB security key for FIDO authentication in Try Omarchy's Linux guest.

With the existing experimental USB passthrough, my YubiKey appeared in Linux as 1050:0406 (YubiKey FIDO+CCID), but the kernel reported can't set config #1, error -32 and no usable HID device appeared. This matches the privilege limitation documented in #236.

Before taking this further, is anyone already working on FIDO-specific forwarding, or would the USB entitlement work cover this soon?

Suggested change

An opt-in bridge for the key's FIDO HID interface:

Mac IOHID -> VM transport -> Linux UHID -> guest browser

We tried this in a running VM and got it working:

A small Mac helper opened the physical YubiKey through IOHID as a normal user, without root or whole-device USB capture.
The Linux helper created a temporary UHID device and dropped root privileges before handling the connection.
The guest received a complete 408-byte authenticatorGetInfo response from the physical key: firmware 5.7.4, capabilities 0x0d.
I successfully signed in to Windows App in the guest's Chromium browser using the key.
Seven synthetic transport tests cover framing, report-ID handling, pairing, continuation-frame reassembly, and disconnect behavior.

The prototype uses a paired loopback TCP connection. For integration, a dedicated virtio-serial channel alongside the existing host integrations seems worth discussing.

I'd keep the initial scope to one explicitly selected USB FIDO security key, browser authentication, and an enable/disable control. The experiment currently selects exactly one Yubico FIDO interface and assumes 64-byte reports. Only my key and Windows App sign-in have been verified; other keys, registration, reconnection, sleep/wake, and host/guest contention still need testing. This is a feasibility result, not a production-ready implementation.

@themartiano @vcanuel — would this be useful alongside #236, and is there overlapping work we should coordinate with before developing it further?

Related: #191 covers phone/QR passkeys; #133 covers Touch ID/Keychain passkeys. This proposal is specifically for forwarding a physical USB FIDO key.

Activity

No activity yet.