An agent, so a finger can mean something in your session

The daemon announces every matched finger on the system bus and stops there,
because root has no session bus, no display and no business starting your
applications. fingerprintd-agent is the other half: it runs as you, subscribes
properly rather than parsing gdbus monitor output, filters by uid because the
signal is visible to every local user, and maps fingers to commands from a file
you own and can edit without restarting anything.

It is a separate binary and a separate subpackage because it is a separate
trust domain. /etc/fingerprintd/actions.conf is a root shell and is guarded
like one; ~/.config/fingerprintd/fingers.conf runs your commands as you, so it
is an ordinary dotfile.

Demonstrated on the phone: one press of the unlock finger both unlocks it and
opens plasma-camera.
This commit is contained in:
Jorijn van der Graaf 2026-09-05 06:21:53 +02:00
commit 1934822554
8 changed files with 264 additions and 2 deletions

View file

@ -47,7 +47,7 @@ provides="fprintd=$pkgver-r$pkgrel"
# system that has systemd. No OpenRC service: nothing here has ever been run
# under one, and the unit's conditions (the vendor blob, /dev/tee0) are what
# keep the package inert on a phone that cannot use it.
subpackages="$pkgname-systemd"
subpackages="$pkgname-agent $pkgname-systemd"
# nothing is compiled here, and the aarch64 ELF's NEEDED entries must not be
# traced against an x86_64 build host
options="!check !tracedeps"
@ -114,6 +114,25 @@ package() {
# feature is off until an administrator installs one.
install -Dm644 actions.conf.example \
"$pkgdir"/usr/share/doc/$pkgname/actions.conf.example
# The session half; split out below.
install -Dm755 fingerprintd-agent "$pkgdir"/usr/bin/fingerprintd-agent
install -Dm644 fingerprintd-agent.service \
"$pkgdir"/usr/lib/systemd/user/fingerprintd-agent.service
install -Dm644 fingers.conf.example \
"$pkgdir"/usr/share/doc/$pkgname/fingers.conf.example
}
agent() {
pkgdesc="Run things in your session when a fingerprint matches"
# Useful only against a daemon that emits the signal, but it is a
# SEPARATE package because it is a separate trust domain: it runs as the
# user, reads a config the user owns, and starts the user's software.
depends="$pkgname=$pkgver-r$pkgrel"
amove usr/bin/fingerprintd-agent
amove usr/lib/systemd/user/fingerprintd-agent.service
amove usr/share/doc/$pkgname/fingers.conf.example
}
systemd() {