Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

text change

Browse source
This commit is contained in:
Jorijn van der Graaf 2026-09-08 16:50:25 +02:00
commit 0b8ff3df9f
1 changed files with 9 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

35
packaging/actions.conf.example
View file

@ -1,19 +1,14 @@
# fingerprintd — per-finger actions.
# fingerprintd per-finger actions.
#
# Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
# exactly what it always did: it unlocks.
#
# YOU PROBABLY DO NOT NEED THIS FILE. Every matched finger is already
# announced on the system bus, unconditionally and with nothing configured:
# This file is for running root scripts on finger actions.
# For scripts that run in your session, you can use this D-Bus:
#
# net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
# on /net/reactivated/Fprint/Device/0
#
# That is how a finger launches an application. An agent in your own session
# hears the signal and decides what the finger means, from your own
# configuration, running as you with your bus and your display. The daemon is
# root and deliberately does not try to do that for you.
#
# This file is for the two things that do need the daemon.
#
# THIS FILE IS A ROOT SHELL. Every command here is run by root when that
@ -38,30 +33,18 @@
# no-unlock this finger never unlocks. The client is told it did not match,
# whatever really happened.
#
# command an ABSOLUTE path, passed to /bin/sh -c with a fixed environment
# plus FINGERPRINTD_FINGER. Double-forked, so it may outlive the
# daemon and can never delay an unlock.
# command an absolute path, passed to /bin/sh -c with a fixed environment
# plus FINGERPRINTD_FINGER.
#
# At least one of the two is required. A finger listed on its own says nothing
# the signal above does not already say.
# --- A finger that also does something, as root -----------------------------
#right-ring-finger /usr/local/bin/toggle-something
# --- A finger that does not unlock ------------------------------------------
#left-thumb no-unlock
#
# --- A duress finger: rejected, and the script runs anyway ------------------
#
# Think carefully before making that script destructive:
#
# * a false accept that opens a camera is a shrug; one that wipes is not,
# * and anyone who can compel one unlock can usually compel a second.
#
# AND KNOW WHAT THIS IS NOT. It is a panic button, not deniability. The
# rejection it fabricates is far faster than a real one — a finger the sensor
# Know what this is not: It is a panic button, not deniability. The
# rejection it fabricates is far faster than a real one. A finger the sensor
# genuinely does not know takes about three seconds to be refused, this takes
# milliseconds — the daemon's journal records that the finger really matched,
# milliseconds. The daemon's journal records that the finger really matched,
# this file names it in plain text, and the finger still shows as enrolled in
# fprintd-list. It reliably runs your script. It does not reliably hide that
# it did.