u2f-devices-usb-device-access.diff

diff --git a/interfaces/builtin/u2f_devices.go b/interfaces/builtin/u2f_devices.go
index 8413c94b2..7a702051f 100644
--- a/interfaces/builtin/u2f_devices.go
+++ b/interfaces/builtin/u2f_devices.go
@@ -121,6 +121,9 @@ var u2fDevices = []u2fDevice{
 const u2fDevicesConnectedPlugAppArmor = `
 # Description: Allow write access to u2f hidraw devices.
 
+# Allow to access all usb devices and rely on the device cgroup for mediation.
+/dev/bus/usb/[0-9][0-9][0-9]/[0-9][0-9][0-9] rw,
+
 # Use a glob rule and rely on device cgroup for mediation.
 /dev/hidraw* rw,
 
@@ -143,6 +146,7 @@ type u2fDevicesInterface struct {
 func (iface *u2fDevicesInterface) UDevConnectedPlug(spec *udev.Specification, plug *interfaces.ConnectedPlug, slot *interfaces.ConnectedSlot) error {
 	for _, d := range u2fDevices {
 		spec.TagDevice(fmt.Sprintf("# %s\nSUBSYSTEM==\"hidraw\", KERNEL==\"hidraw*\", ATTRS{idVendor}==\"%s\", ATTRS{idProduct}==\"%s\"", d.Name, d.VendorIDPattern, d.ProductIDPattern))
+		spec.TagDevice(fmt.Sprintf("SUBSYSTEM==\"usb\", ATTRS{idVendor}==\"%s\", ATTRS{idProduct}==\"%s\"", d.VendorIDPattern, d.ProductIDPattern))
 	}
 	return nil
 }