UDEV Rule Not Triggering

Question

I have gone through 10s of answers on this and other sites trying to debug my udev rule, but to no avail. The rule is very simple: I want to lock my screen when my Yubikey is unplugged.

• My rule is in the file /etc/udev/rules.d/98-yubikey.rules.
• I have tried both # udevadm control --reload-rules && udevadm trigger and simply rebooting my computer to update the rules.

Here are the rules I have tried so far, none of which lock the screen (I have tested that the script does, in fact, lock the screen when run).

1. ACTION=="remove", SUBSYSTEM=="input", ATTRS{idVendor}=="XXXX", ATTRS{idProduct}=="YYYY", RUN+="/home/user/bin/lock_screen", OWNER="user"
2. ACTION=="add", SUBSYSTEM=="input", ENV{ID_VENDOR_ID}=="XXXX", ENV{ID_MODEL_ID}=="YYYY", RUN+="/home/user/bin/lock_screen", OWNER="user"
3. Various combinations of these items with or without subsystem/owner (and with subsystem as usb instead of input).

Answer 1

I have a system configured to do the same and it looks like this:

SUBSYSTEM=="input", ACTION=="remove", RUN+="/usr/local/sbin/yubikey_gone"

Then the script /usr/local/sbin/yubikey_gone contains:

#!/bin/sh

if [ "x$ID_MODEL" != "xYubico_Yubikey_II" ]; then
    exit 0
fi

exec su vandry -c "DISPLAY=:0.0 gnome-screensaver-command --lock"

This invokes the script when any input device is unplugged, and then the script tests whether or not it indeed was a Yubikey before proceeding. It's not the correct solution, but I must have had trouble getting it to work with the device model test directly in the udev configuration file (I don't remember why — the script hasn't been touched in a long time). It's not the best way, but it does at least work.