Please enable CONFIG_HIDRAW & CONFIG_USB_HIDDEV in WSL kernel for using SmartCards

[dwhobrey]

Windows Version

23H2 25951.1010

WSL Version

2.0.1.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

5.15.123.1-1

Distro Version

OracleLinux_9_1

Other Software

Latest usbipd-win 3.2.0.
Yubikey on Windows.
pcscd running on WSL,
pcscd logs don't report any access problems.
polkit rules defined so usb accessible by non root users.
piv-tool -n and opensc-tool -n both report access to Yubikey for user.

Repro Steps

Attaching Yubikey via usbipd / usbip & running browser (firefox or chrome) in WSL with fido2 / u2f enabled.
Browser prompts for yubikey password on start.
Navigating to site that require u2f/ fido2:
pcscd logs show browser can probe Yubikey, but OTP/CTAP2 (chip touch) does not work.
That is, Yubikey does not blink when browser shows u2f dialog.
For firefox about:config, webAuth settings all true for otp, fido2 ctap2 etc.

Expected Behavior

Yubikey Leds shoudl blink when browser shows u2f dialog.

Actual Behavior

Yubikey does not flash or respond to touch.
Note, attempting same thing from a VirtualBox VM running OracleLinux does work.
Dumping driver info via
usb_devices and lsusb -v -t,
shows WSL and VB VM both using same drivers for smartcard.

Diagnostic Logs

No response

[dwhobrey]

Here's full steps to build kernel with flags & final test using Yubico's fido2-token utility to enumerate yubikey's mounted as hidraw devices.

Create wsl file .wslconfig in your Windows home folder (C:\USERS\YourName) with contents:

[experimental]
sparseVhd=true
networkingMode=mirrored
dnsTunneling=true
firewall=true
autoProxy=true

autoMemoryReclaim=gradual

Install latest wsl2 & OL9

Note msi's can be downloaded from release page, such as here: https://github.com/microsoft/WSL/releases/tag/2.0.3

Update Windows to 23H2 (OS Build 25951.1010), see Windows 11 Pro Insider Preview Canary option.

Update wsl

wsl --update --pre-release

Install OL9

wsl --install -d OracleLinux_9_1

Start terminal from Terminal

Perform all these as root.

Change sudoers to allow wheel group no passwd:

sudo visudo

Add # to first wheel entry, and remove from second entry.

Contents of /etc/wsl.conf

sudo vi /etc/wsl.conf
[boot]
systemd=true

Restart from Powershell via wsl --shutdown

Update packages as root

sudo -i
yum -y upgrade
yum -y update

Restart from Powershell via wsl --shutdown

Setting up Yubikey sharing via usbip
Build WSL OL9 kernel to support HIDRAW & HIDDEV

From within WSL:

sudo -i
yum install gcc gcc-c++ kernel-devel make git bc dwarves

cd /opt
git clone https://github.com/microsoft/WSL2-Linux-Kernel.git
cd WSL2-Linux-Kernel
vi Microsoft/config-wsl and enable CONFIG_HIDRAW & CONFIG_USB_HIDDEV.
make KCONFIG_CONFIG=Microsoft/config-wsl

choose default options

cp arch/x86/boot/bzImage /mnt/c/Users/YOUR_USER/
vi /mnt/c/Users/YOUR_USER/.wslconfig, and add:
[wsl2]
kernel=C:\Users\YOUR_USER\bzImage

Restart from Powershell via wsl --shutdown

Check new kernel is running from within WSL via:

uname -a
Setup usbipd on Windows

On Windows install latest (3.2.0+) usbipd-win from here:

https://github.com/dorssel/usbipd-win/releases.

Setup usbip on WSL

Setting up usbip on WSL inorder to use Yubikey from Windows host

Start with usb utils, which also installs hwdata:

yum install usbutils

Test via

lsusb

Should show a couple of MS vhci devices.

Set up access to elrepo for OL9:

rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
yum install https://www.elrepo.org/elrepo-release-9.el9.elrepo.noarch.rpm

yum install usbip-utils.x86_64

Restart from Powershell via wsl --shutdown

To check usbip works, from admin Powershell, share the Windows YubiKey usb device:

Note busid may be different, find it via usbipd list.

usbipd bind --busid=1-4

From wsl2 terminal attach to the device:

usbip attach --remote=127.0.0.1 --busid=1-4

Check via lsusb -v -t that it's seen & that If 2 Driver=usbfs (only when pcscd installed).

Access to hidraw devices - needed for yubikey OTP etc.

yum install systemd-udev
vi /etc/udev/rules.d/10-yubi.rules, add:
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", MODE="0660", GROUP="wheel", TAG+="uaccess"

Useful tool from libfido2 to check if access to yubikey works:

Should list yubikey device if accessible, otherwise reports permission denied.

fido2-token -dL

[hernandp]

Thanks for this information. I needed this also for making Ledger Nano device to work under WSL.

[kelsey-steele]

CONFIG_HIDRAW and CONFIG_USB_HIDDEV are now enabled in the latest WSL2 kernel release linux-msft-wsl-5.15.150.1

Please keep in mind the kernel is released to the WSL2-linux-kernel repo first and will be included in an upcoming WSL release.

[dwhobrey]

Hi Kelsey, That’s great news! 😊 Thank you.