Repository navigation
Share a Mac-connected USB FIDO security key with the guest #392
Description
What would you like to improve?
I'd like to use a Mac-connected USB security key for FIDO authentication in Try Omarchy's Linux guest.
With the existing experimental USB passthrough, my YubiKey appeared in Linux as 1050:0406 (YubiKey FIDO+CCID), but the kernel reported can't set config #1, error -32 and no usable HID device appeared. This matches the privilege limitation documented in #236.
Before taking this further, is anyone already working on FIDO-specific forwarding, or would the USB entitlement work cover this soon?
Suggested change
An opt-in bridge for the key's FIDO HID interface:
Mac IOHID -> VM transport -> Linux UHID -> guest browser
We tried this in a running VM and got it working:
- A small Mac helper opened the physical YubiKey through IOHID as a normal user, without root or whole-device USB capture.
- The Linux helper created a temporary UHID device and dropped root privileges before handling the connection.
- The guest received a complete 408-byte
authenticatorGetInforesponse from the physical key: firmware 5.7.4, capabilities0x0d. - I successfully signed in to Windows App in the guest's Chromium browser using the key.
- Seven synthetic transport tests cover framing, report-ID handling, pairing, continuation-frame reassembly, and disconnect behavior.
The prototype uses a paired loopback TCP connection. For integration, a dedicated virtio-serial channel alongside the existing host integrations seems worth discussing.
I'd keep the initial scope to one explicitly selected USB FIDO security key, browser authentication, and an enable/disable control. The experiment currently selects exactly one Yubico FIDO interface and assumes 64-byte reports. Only my key and Windows App sign-in have been verified; other keys, registration, reconnection, sleep/wake, and host/guest contention still need testing. This is a feasibility result, not a production-ready implementation.
@themartiano @vcanuel — would this be useful alongside #236, and is there overlapping work we should coordinate with before developing it further?
Related: #191 covers phone/QR passkeys; #133 covers Touch ID/Keychain passkeys. This proposal is specifically for forwarding a physical USB FIDO key.
Activity
vcanuel commentedon Oct 20, 2026
Thanks, nice work! No overlap with #236: your bridge works at the HID level, so it sidesteps the libusb privilege issue instead of depending on it, and the key stays usable on the Mac.
I think it's a sound approach as long as it stays opt-in. If you take it further, matching any FIDO key rather than Yubico only, and moving to virtio-serial as you suggested, seem like the right next steps.
deaddeadbeef commentedon Oct 25, 2026
@vcanuel, thanks for your suggestions! PR #406 adds opt-in, vendor-independent FIDO forwarding over virtio-serial. The selected FIDO interface is unavailable on Mac while forwarded. Would you mind taking a look? Thanks!