I have gone through 10s of answers on this and other sites trying to debug my udev rule, but to no avail. The rule is very simple: I want to lock my screen when my Yubikey is unplugged.

  • My rule is in the file /etc/udev/rules.d/98-yubikey.rules.
  • I have tried both # udevadm control --reload-rules && udevadm trigger and simply rebooting my computer to update the rules.

Here are the rules I have tried so far, none of which lock the screen (I have tested that the script does, in fact, lock the screen when run).

  1. ACTION=="remove", SUBSYSTEM=="input", ATTRS{idVendor}=="XXXX", ATTRS{idProduct}=="YYYY", RUN+="/home/user/bin/lock_screen", OWNER="user"
  2. ACTION=="add", SUBSYSTEM=="input", ENV{ID_VENDOR_ID}=="XXXX", ENV{ID_MODEL_ID}=="YYYY", RUN+="/home/user/bin/lock_screen", OWNER="user"
  3. Various combinations of these items with or without subsystem/owner (and with subsystem as usb instead of input).
  • Can you share the lock_screen script? How are you trying to run it? The script may need some variables that are not defined when it is run from udev, how are you handling this?
    – njsg
    Dec 13, 2014 at 21:13

1 Answer 1


I have a system configured to do the same and it looks like this:

SUBSYSTEM=="input", ACTION=="remove", RUN+="/usr/local/sbin/yubikey_gone"

Then the script /usr/local/sbin/yubikey_gone contains:


if [ "x$ID_MODEL" != "xYubico_Yubikey_II" ]; then
    exit 0

exec su vandry -c "DISPLAY=:0.0 gnome-screensaver-command --lock"

This invokes the script when any input device is unplugged, and then the script tests whether or not it indeed was a Yubikey before proceeding. It's not the correct solution, but I must have had trouble getting it to work with the device model test directly in the udev configuration file (I don't remember why — the script hasn't been touched in a long time). It's not the best way, but it does at least work.

  • Thanks! A couple notes: I changed the username in the command on the last line, I use xscreensaver so I changed the command in quotes on the last line to "xscreensaver-command --lock", and I have a yubikey neo-n, so the $ID_MODEL is Yubikey_NEO_OTP+U2F+CCID (which I assume changes based on what modes I have enabled). Dec 13, 2014 at 21:18
  • 1
    By the way, why is there an "x" before $ID_MODEL and the string you're testing against? Dec 13, 2014 at 21:20
  • Yes, my script is quite an ugly hack customized to me so I expected you'd have to change a few things :-)
    – Celada
    Dec 13, 2014 at 22:33
  • 1
    x is a guard in case $ID_MODEL starts with a character that has special meaning to the test builtin, like -. The other way to do it is to write the test the other way around, like [ Yubico_Yubikey_II != "$ID_MODEL" ] which I believe is just as good.
    – Celada
    Dec 13, 2014 at 22:35
  • Haha just wanted to clarify in case someone else came along and found this answer useful :P Dec 14, 2014 at 19:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .