Lock (Gnome) session when removing Yubico U2F key

1-Yubikey_session_lock.md

Setup

1. Copy 99-u2f_lock_screen.rules to /etc/udev/rules.d.
2. Copy gnome_lock_all_sessions to /usr/local/bin.
3. Mark gnome_lock_all_sessions as executable: chmod +x /usr/local/bin/gnome_lock_all_sessions
4. Reload udev: udevadm control -R

99-u2f_lock_screen.rules

ACTION=="remove", SUBSYSTEM=="usb", ENV{ID_MODEL_FROM_DATABASE}=="Yubikey Touch U2F Security Key", RUN+="/usr/local/bin/gnome_lock_all_sessions"

gnome_lock_all_sessions

#!/bin/sh
# List available names
# dbus-send --session --dest=org.freedesktop.DBus --type=method_call --print-reply  /org/freedesktop/DBus org.freedesktop.DBus.ListNames
# Lock session (Gnome)
# dbus-send --session --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.Lock
# Unlock session (Gnome)
#dbus-send --session --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.SetActive boolean:false
# Lock session (freedesktop) (no effect?)
# dbus-send --session --type=method_call --dest=org.freedesktop.ScreenSaver /org/freedesktop/ScreenSaver org.freedesktop.ScreenSaver.Lock

for bus in /run/user/*/bus; do
  uid=$(basename $(dirname $bus))
  if [ $uid -ge 1000 ]; then
    user=$(id -un $uid)
    export DBUS_SESSION_BUS_ADDRESS=unix:path=$bus
    if su -c 'dbus-send --session --dest=org.freedesktop.DBus --type=method_call --print-reply  /org/freedesktop/DBus org.freedesktop.DBus.ListNames' $user | grep org.gnome.ScreenSaver; then
      su -c 'dbus-send --session --type=method_call --dest=org.gnome.ScreenSaver /org/gnome/ScreenSaver org.gnome.ScreenSaver.Lock' $user
    fi
   fi
done

Any idea why running this would cause gnome to lock every time I run sudo? I've used it in combination with a challenge-response as sufficient on /etc/pam.d/sudo. Works like a breeze but gnome locks each time I run sudo now.

love the script btw thanks!

# Lock session (freedesktop/KDE)
dbus-send --session --type=method_call --dest=org.freedesktop.ScreenSaver --print-reply --reply-timeout=20000 /org/freedesktop/ScreenSaver org.freedesktop.ScreenSaver.SetActive boolean:true