53 lines
2.3 KiB
Text
53 lines
2.3 KiB
Text
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
|
<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
|
||
|
|
<!-- SPDX-License-Identifier: GPL-3.0-only
|
||
|
|
SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
||
|
|
|
||
|
|
fingerprintd owns net.reactivated.Fprint, which excludes the fprintd
|
||
|
|
package and the actions file it ships. These are the same three action
|
||
|
|
ids with the same defaults, so a client that consults them — or a site
|
||
|
|
that has already written rules against them — sees no change.
|
||
|
|
|
||
|
|
NOT YET ENFORCED. The daemon currently authorizes by caller uid: a
|
||
|
|
client may act on its own prints and no other user's. That is stricter
|
||
|
|
than allow_active=yes for verify and LOOSER than auth_self_keep for
|
||
|
|
enroll, which asks the user to re-authenticate first. Enforcing these
|
||
|
|
needs a polkit agent to be reachable, and the FP6 does not have a
|
||
|
|
working session UI yet, so it would today block enrolment on the one
|
||
|
|
device that can test it. Tracked in the fp6 journal's fingerprint lane.
|
||
|
|
Install: /usr/share/polkit-1/actions/ -->
|
||
|
|
<policyconfig>
|
||
|
|
<vendor>Catcrafts</vendor>
|
||
|
|
<vendor_url>https://forgejo.catcrafts.net/Catcrafts/fingerprintd</vendor_url>
|
||
|
|
<icon_name>fingerprint</icon_name>
|
||
|
|
|
||
|
|
<action id="net.reactivated.fprint.device.verify">
|
||
|
|
<description>Verify a fingerprint</description>
|
||
|
|
<message>Privileges are required to verify fingerprints.</message>
|
||
|
|
<defaults>
|
||
|
|
<allow_any>no</allow_any>
|
||
|
|
<allow_inactive>no</allow_inactive>
|
||
|
|
<allow_active>yes</allow_active>
|
||
|
|
</defaults>
|
||
|
|
</action>
|
||
|
|
|
||
|
|
<action id="net.reactivated.fprint.device.enroll">
|
||
|
|
<description>Enroll new fingerprints</description>
|
||
|
|
<message>Privileges are required to enroll new fingerprints.</message>
|
||
|
|
<defaults>
|
||
|
|
<allow_any>no</allow_any>
|
||
|
|
<allow_inactive>no</allow_inactive>
|
||
|
|
<allow_active>auth_self_keep</allow_active>
|
||
|
|
</defaults>
|
||
|
|
</action>
|
||
|
|
|
||
|
|
<action id="net.reactivated.fprint.device.setusername">
|
||
|
|
<description>Select a user to enroll</description>
|
||
|
|
<message>Privileges are required to select a user to enroll.</message>
|
||
|
|
<defaults>
|
||
|
|
<allow_any>no</allow_any>
|
||
|
|
<allow_inactive>no</allow_inactive>
|
||
|
|
<allow_active>auth_admin_keep</allow_active>
|
||
|
|
</defaults>
|
||
|
|
</action>
|
||
|
|
</policyconfig>
|