homed: allow systemd-homed access to FIDO2 devices

Add DeviceAllow= option for FIDO2 devices in systemd-homed.service.

diff --git a/units/systemd-homed.service.in b/units/systemd-homed.service.in
index 678bbab65c464b145c8ba9210c4373e3ee2d376d..0576f84697423b4a9d2e7abeb154fffb25cf2521 100644 (file)
--- a/units/systemd-homed.service.in
+++ b/units/systemd-homed.service.in
@@ -20,6 +20,7 @@ CapabilityBoundingSet=CAP_SYS_ADMIN CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FS
 DeviceAllow=/dev/loop-control rw
 DeviceAllow=/dev/mapper/control rw
 DeviceAllow=block-* rw
+DeviceAllow=char-hidraw rw
 ExecStart={{ROOTLIBEXECDIR}}/systemd-homed
 IPAddressDeny=any
 KillMode=mixed