I have gone through 10s of answers on this and other sites trying to debug my udev rule, but to no avail. The rule is very simple: I want to lock my screen when my Yubikey is unplugged.

  • My rule is in the file /etc/udev/rules.d/98-yubikey.rules.
  • I have tried both # udevadm control --reload-rules && udevadm trigger and simply rebooting my computer to update the rules.

Here are the rules I have tried so far, none of which lock the screen (I have tested that the script does, in fact, lock the screen when run).

  1. ACTION=="remove", SUBSYSTEM=="input", ATTRS{idVendor}=="XXXX", ATTRS{idProduct}=="YYYY", RUN+="/home/user/bin/lock_screen", OWNER="user"
  2. ACTION=="add", SUBSYSTEM=="input", ENV{ID_VENDOR_ID}=="XXXX", ENV{ID_MODEL_ID}=="YYYY", RUN+="/home/user/bin/lock_screen", OWNER="user"
  3. Various combinations of these items with or without subsystem/owner (and with subsystem as usb instead of input).
  • Can you share the lock_screen script? How are you trying to run it? The script may need some variables that are not defined when it is run from udev, how are you handling this?
    – njsg
    Dec 13, 2014 at 21:13

1 Answer 1


I have a system configured to do the same and it looks like this:

SUBSYSTEM=="input", ACTION=="remove", RUN+="/usr/local/sbin/yubikey_gone"

Then the script /usr/local/sbin/yubikey_gone contains:


if [ "x$ID_MODEL" != "xYubico_Yubikey_II" ]; then
    exit 0

exec su vandry -c "DISPLAY=:0.0 gnome-screensaver-command --lock"

This invokes the script when any input device is unplugged, and then the script tests whether or not it indeed was a Yubikey before proceeding. It's not the correct solution, but I must have had trouble getting it to work with the device model test directly in the udev configuration file (I don't remember why — the script hasn't been touched in a long time). It's not the best way, but it does at least work.

  • Thanks! A couple notes: I changed the username in the command on the last line, I use xscreensaver so I changed the command in quotes on the last line to "xscreensaver-command --lock", and I have a yubikey neo-n, so the $ID_MODEL is Yubikey_NEO_OTP+U2F+CCID (which I assume changes based on what modes I have enabled). Dec 13, 2014 at 21:18
  • 1
    By the way, why is there an "x" before $ID_MODEL and the string you're testing against? Dec 13, 2014 at 21:20
  • Yes, my script is quite an ugly hack customized to me so I expected you'd have to change a few things :-)
    – Celada
    Dec 13, 2014 at 22:33
  • 1
    x is a guard in case $ID_MODEL starts with a character that has special meaning to the test builtin, like -. The other way to do it is to write the test the other way around, like [ Yubico_Yubikey_II != "$ID_MODEL" ] which I believe is just as good.
    – Celada
    Dec 13, 2014 at 22:35
  • Haha just wanted to clarify in case someone else came along and found this answer useful :P Dec 14, 2014 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.