[Bug] `50-qmk.rules` Broken on systemd 258.

[WindFreaker]

Describe the Bug

A change to systemd with version 258 seems to have broken a lot of people's udev rules, and now the provided udev rule file no longer works. I managed to solve this issue by finding someone in a similar situation and using their fix, but I don't know enough about udev rules or how things are supposed to work to propose a PR with this fix or any other potential fix. All I know is it seems this change by systemd is intentional and not being reverted anytime soon, so I thought to bring it up and hopefully help others avoid the headache I just spent all day figuring out.

Keyboard Used

No response

Link to product page (if applicable)

No response

Operating System

No response

qmk doctor Output

Is AutoHotKey / Karabiner installed

• AutoHotKey (Windows)
• Karabiner (macOS)

Other keyboard-related software installed

No response

Additional Context

No response

[tzarc]

Sigh. systemd strikes again.

I'll try and have a look at it in the coming weeks but had some pretty significant IRL events occur so I can't promise anything.

With any luck we can leverage something on systemd/systemd#39056. Irritating.

[sigprof]

Hmm, the only rule which could be hit by that change is

# hid_listen
KERNEL=="hidraw*", MODE="0660", GROUP="plugdev", TAG+="uaccess", TAG+="udev-acl"

So you were relying on that rule, and plugdev was not a system group?

That rule should probably be reduced to

KERNEL=="hidraw*", TAG+="uaccess"

(TAG+="udev-acl" is also something obsolete, and the plugdev group was found mostly in Debian, so the rule already generated warnings on other distros)

BTW, a better version of that rule (which actually checks HID usages instead of blindly opening access to all hidraw devices) is in https://github.com/qmk/qmk_udev, but it needs a compiled helper program.

[WindFreaker]

So you were relying on that rule, and plugdev was not a system group?

I think because that rule exists the entire file fails to load. Any error scraps the whole thing.

[gibs2193]

BTW, a better version of that rule (which actually checks HID usages instead of blindly opening access to all hidraw devices) is in https://github.com/qmk/qmk_udev, but it needs a compiled helper program.

I found the standard udev rules, that are usually recommended to be way too permissive, they open up user level access to the keyboard output which is pretty bad imo.

I use this one based on ENV:

# Block user level access to keyboard output (interface 0)
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
  ENV{ID_VENDOR_ID}=="362d", ENV{ID_MODEL_ID}=="0611", \
  ENV{ID_USB_INTERFACE_NUM}=="00", MODE="0000"

# Allow access to QMK debug console interface (0xFF31), interface 2
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
  ENV{ID_VENDOR_ID}=="362d", ENV{ID_MODEL_ID}=="0611", \
  ENV{ID_USB_INTERFACE_NUM}=="02", MODE="0660", GROUP="users", TAG+="uaccess"

# Allow secure Raw HID interface (0xFF60), interface 1
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
  ENV{ID_VENDOR_ID}=="362d", ENV{ID_MODEL_ID}=="0611", \
  ENV{ID_USB_INTERFACE_NUM}=="01", MODE="0660", GROUP="users", TAG+="uaccess"

This way there's no user level access to the actual output of the keyboard, VIA HID interface is read/write for changing settings with VIA/Vial etc. And there's also read access to QMK debug console HID interface.

Still not sure if ID_USB_INTERFACE_NUM is the same on each keyboard, 00 should be main keyboard output, 01 should be VIA HID and 02 should be QMK debug console.
Still needs product/vendor IDs.

[sigprof]

Still not sure if ID_USB_INTERFACE_NUM is the same on each keyboard, 00 should be main keyboard output, 01 should be VIA HID and 02 should be QMK debug console.

Interface numbers are not stable — they need to be assigned sequentially, and the only thing which QMK tries to guarantee is that if rawhid is enabled, the corresponding interface index is 1 (because at least some old VIA app versions had that assumption hardcoded). In particular, the debug console interface does not have a fixed index. And even index 1 can be something else than rawhid/VIA if rawhid is not enabled.

So the only way to find the console and rawhid interfaces automatically is to parse the HID report descriptor using a custom helper program and check for matching HID usages. (Even that is not 100% correct according to the USB standards, because the HID usages used for those descriptors are not registered anywhere — they are from the vendor defined space, so they are supposed to be interpreted together with the USB VID, but QMK does not own various VIDs which are used by keyboards.)

[gibs2193]

To be honest my main concern is having interface 0 with user level access, that's a big security issue. Any user level process can record all keystrokes.
For VIA you can spray&pray for interfaces 1-9, that's not as important security wise. For me random processes having access to interface 0 is a bigger issue than VIA interface not being accessible. You can whitelist bInterface 1-9 for VIA access, and blacklist interface 0.

[tzarc]

Not that simple; depending on how descriptors get shared, things like digitizer, mouse, joystick etc. may end up as something non-zero. If you're not keen on user inputs being exposed, then blindly allowing 1+ isn't going to be sufficient.

[gibs2193]

That may be so but the amount of useful information joystick/mouse movements expose, compared to full keystroke output, is irrelevant by comparison. If your threat model requires you don't leak mouse movements you probably know what you need to do anyway, you do not rely on stock udev rules.

[tzarc]

Well, seeing as your focus seems to be keystrokes... NKRO reports are on a non-zero EP as well, by default.

A comprehensive solution is necessary.

[gibs2193]

They are on 0 if KEYBOARD_SHARED_EP is used. I didn't notice NKRO and others are on a different interface since I always had that set.

[gibs2193]

Well, seeing as your focus seems to be keystrokes... NKRO reports are on a non-zero EP as well, by default.

A comprehensive solution is necessary.

This requires python hid and isolates all interfaces + vendor/product ID. QMK app could run it once VIA is enabled.

#!/usr/bin/env python3
import hid
from collections import defaultdict

def print_device(dev):
    """Pretty-print a single device dictionary with all fields."""
    print(f"Path: {dev['path']}")
    print(f"  Vendor ID: 0x{dev['vendor_id']:04X}")
    print(f"  Product ID: 0x{dev['product_id']:04X}")
    print(f"  Manufacturer: {dev.get('manufacturer_string', 'Unknown')}")
    print(f"  Product: {dev.get('product_string', 'Unknown')}")
    print(f"  Serial Number: {dev.get('serial_number', 'Unknown')}")
    print(f"  Usage Page: 0x{dev['usage_page']:04X}")
    print(f"  Usage: 0x{dev['usage']:04X}")
    print(f"  Interface Number: {dev['interface_number']}")
    print(f"  Release Number: {dev['release_number']}")
    print("-" * 60)

def main():
    # Enumerate ALL HID devices on the system
    devices = hid.enumerate()
    
    print(f"\nSearching {len(devices)} HID devices for usage page 0xFF60...\n")
    
    # First pass: find any device with usage page 0xFF60
    target_vendor_id = None
    target_product_id = None
    found_ff60 = False
    
    for device in devices:
        if device['usage_page'] == 0xFF60:
            target_vendor_id = device['vendor_id']
            target_product_id = device['product_id']
            found_ff60 = True
            print(f"*** FOUND USAGE PAGE 0xFF60 ***")
            print(f"*** Target Vendor ID: 0x{target_vendor_id:04X} ***")
            print(f"*** Target Product ID: 0x{target_product_id:04X} ***")
            print()
            break
    
    if not found_ff60:
        print("No device with usage page 0xFF60 found.")
        return
    
    print("="*60)
    print(f"Vendor:0x{target_vendor_id:04X} Product:0x{target_product_id:04X}")
    print("="*60)
    
    # Second pass: show ONLY devices with matching vendor/product ID
    matching_devices = []
    for device in devices:
        if (device['vendor_id'] == target_vendor_id and 
            device['product_id'] == target_product_id):
            matching_devices.append(device)
            print(f"Interface {device['interface_number']}:")
            print(f"  Usage Page: 0x{device['usage_page']:04X}")
            print(f"  Usage: 0x{device['usage']:04X}")
            print(f"  Path: {device['path']}")
            print()
    
    print(f"Total interfaces for 0xFF60 device: {len(matching_devices)}")
    print("="*60)

if __name__ == "__main__":
    main()

And result is this in my case:

Searching 12 HID devices for usage page 0xFF60...

*** FOUND USAGE PAGE 0xFF60 ***
*** Target Vendor ID: 0x362D ***
*** Target Product ID: 0x0611 ***

============================================================
Vendor:0x362D Product:0x0611
============================================================
Interface 0:
  Usage Page: 0x0001
  Usage: 0x0006
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x0001
  Usage: 0x0080
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x000C
  Usage: 0x0001
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x0001
  Usage: 0x0006
  Path: b'/dev/hidraw3'

Interface 1:
  Usage Page: 0xFF60
  Usage: 0x0061
  Path: b'/dev/hidraw4'

Total interfaces for 0xFF60 device: 5
============================================================

This finds all the required data to assemble a proper udev rule once VIA is enabled, and 0xFF60 is detected. Uses the vendor/product ID of 0xFF60 interface to search for every other interface with same vendor/product ID.
Not recommending this exact script, this is for demo on how to get the required data.

Edit:

This is with as many as I could fit, and with KEYBOARD_SHARED_EP = yes

============================================================
Vendor:0x362D Product:0x0611
============================================================
Interface 0:
  Usage Page: 0x0001
  Usage: 0x0006
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x0001
  Usage: 0x0002
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x000D
  Usage: 0x0001
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x0001
  Usage: 0x0080
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x000C
  Usage: 0x0001
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x0001
  Usage: 0x0006
  Path: b'/dev/hidraw3'

Interface 1:
  Usage Page: 0xFF60
  Usage: 0x0061
  Path: b'/dev/hidraw4'

Interface 2:
  Usage Page: 0xFF31
  Usage: 0x0074
  Path: b'/dev/hidraw5'

Total interfaces for 0xFF60 device: 8
============================================================

So still only three interfaces, 0/1/2. 0xFF60 is VIA and 0xFF31 is QMK debug.

And without KEYBOARD_SHARED_EP, and without QMK debug, but with a lot of others:

============================================================
Vendor:0x362D Product:0x0611
============================================================
Interface 0:
  Usage Page: 0x0001
  Usage: 0x0006
  Path: b'/dev/hidraw3'

Interface 1:
  Usage Page: 0xFF60
  Usage: 0x0061
  Path: b'/dev/hidraw4'

Interface 2:
  Usage Page: 0x0001
  Usage: 0x0002
  Path: b'/dev/hidraw5'

Interface 2:
  Usage Page: 0x000D
  Usage: 0x0001
  Path: b'/dev/hidraw5'

Interface 2:
  Usage Page: 0x0001
  Usage: 0x0080
  Path: b'/dev/hidraw5'

Interface 2:
  Usage Page: 0x000C
  Usage: 0x0001
  Path: b'/dev/hidraw5'

Interface 2:
  Usage Page: 0x0001
  Usage: 0x0006
  Path: b'/dev/hidraw5'

Total interfaces for 0xFF60 device: 7
============================================================

So the two important ones are 0xFF60 for VIA and 0xFF31 for QMK debug console, these need access. If VIA/QMK debug are not enabled there's no need for a udev rule.
At least for me 0xFF60 is always on interface 01 and 0xFF31 is always on interface 02. Keyboard output is always on interface 00. Mine uses a STM32F401 not sure how many interfaces others support.

[gibs2193]

Or directly run this and it will output the correct udev rule/rules based on your setup. There is no need for an initial permissive udev rule.
pip install hid

#!/usr/bin/env python3
import hid
from collections import defaultdict

USAGE_RULES = {
    0xFF60: {
        "comment": "Allow Raw HID interface (0xFF60)",
        "mode": "0660",
    },
    0xFF31: {
        "comment": "Allow QMK console interface (0xFF31)",
        "mode": "0660",
    },
}

def main():
    devices = hid.enumerate()

    # Collect interfaces by (vendor, product, usage_page)
    matches = defaultdict(list)

    for dev in devices:
        usage_page = dev.get("usage_page")
        if usage_page in USAGE_RULES:
            key = (dev["vendor_id"], dev["product_id"], usage_page)
            matches[key].append(dev)

    if not matches:
        print("# No matching HID interfaces found.")
        return

    for (vendor_id, product_id, usage_page), interfaces in sorted(matches.items()):
        rule = USAGE_RULES[usage_page]

        for dev in sorted(interfaces, key=lambda d: d["interface_number"]):
            iface_num = f"{dev['interface_number']:02d}"

            print(f"# {rule['comment']}, interface {iface_num}")
            print(
                'KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \\'
            )
            print(
                f'  ENV{{ID_VENDOR_ID}}=="{vendor_id:04x}", '
                f'ENV{{ID_MODEL_ID}}=="{product_id:04x}", \\'
            )
            print(
                f'  ENV{{ID_USB_INTERFACE_NUM}}=="{iface_num}", '
                f'MODE="{rule["mode"]}", GROUP="users", TAG+="uaccess"\n'
            )

if __name__ == "__main__":
    main()

Seems to run fine for me, tested with just VIA on, just QMK debug, and both. Create a new udev rule with the text output of the script.
Can anyone test it?