61 lines
2.9 KiB
Text
61 lines
2.9 KiB
Text
|
# fingerprintd — per-finger actions.
|
||
|
|
#
|
||
|
|
# Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
|
||
|
|
# exactly what it always did: it unlocks, and nothing else happens.
|
||
|
|
#
|
||
|
|
# THIS FILE IS A ROOT SHELL. Every `system` line is a command root runs when
|
||
|
|
# that finger touches the sensor, so anything able to write this file owns the
|
||
|
|
# machine at the next press. fingerprintd refuses the whole file — not just the
|
||
|
|
# offending line — unless root owns it and no one else can write it:
|
||
|
|
#
|
||
|
|
# sudo install -Dm644 -o root -g root actions.conf.example \
|
||
|
|
# /etc/fingerprintd/actions.conf
|
||
|
|
#
|
||
|
|
# It is read once, at startup. Editing it means restarting the unit, which is
|
||
|
|
# also when you get to see the parse errors.
|
||
|
|
#
|
||
|
|
# Format, four fields:
|
||
|
|
#
|
||
|
|
# <finger> <where> <verdict> <command...>
|
||
|
|
#
|
||
|
|
# finger an fprintd finger name: left-thumb, left-index-finger,
|
||
|
|
# left-middle-finger, left-ring-finger, left-little-finger, and
|
||
|
|
# the right-* equivalents.
|
||
|
|
#
|
||
|
|
# where system root runs the command below.
|
||
|
|
# session no command here. The daemon emits
|
||
|
|
# net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
|
||
|
|
# and an agent in your session decides what it means.
|
||
|
|
# This is how you launch an application: root has no
|
||
|
|
# session bus and no display, and running your software
|
||
|
|
# as root to get one would be a poor trade.
|
||
|
|
#
|
||
|
|
# verdict match the client is told the finger matched. Normal.
|
||
|
|
# no-match the client is told it did NOT, whatever really
|
||
|
|
# happened, while the action runs anyway.
|
||
|
|
#
|
||
|
|
# command an ABSOLUTE path, required for system, forbidden for session.
|
||
|
|
# It is passed to /bin/sh -c with a fixed environment plus
|
||
|
|
# FINGERPRINTD_FINGER. It is double-forked, so it may outlive the
|
||
|
|
# daemon and will never delay an unlock.
|
||
|
|
#
|
||
|
|
# A finger with no line here is untouched.
|
||
|
|
|
||
|
|
# --- Launching things in your session -----------------------------------
|
||
|
|
# The daemon only announces the finger; your agent maps it to an app.
|
||
|
|
#right-ring-finger session match
|
||
|
|
|
||
|
|
# --- A duress finger ------------------------------------------------------
|
||
|
|
# The phone reports that it did not recognise this finger, and runs the
|
||
|
|
# script anyway. Think carefully before making that script destructive:
|
||
|
|
#
|
||
|
|
# * a false accept that opens a camera is a shrug; one that wipes is not,
|
||
|
|
# * and anyone who can compel one unlock can usually compel a second, so
|
||
|
|
# this is a panic button, not protection for data at rest. Only
|
||
|
|
# encryption is that, and by unlock time your session is already
|
||
|
|
# decrypted in RAM.
|
||
|
|
#
|
||
|
|
#left-little-finger system no-match /etc/fingerprintd/panic.sh
|
||
|
|
|
||
|
|
# --- Something harmless to try it with ------------------------------------
|
||
|
|
#left-thumb system match /usr/bin/logger -t fingerprintd "thumb"
|