Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Drop two fields nobody needed: session was a no-op, and no-unlock is the finger

Browse source 
Jorijn caught both.

`session` declared nothing. The FingerMatched signal is emitted for every
matched finger unconditionally -- it never consulted the config -- so a
`session` line was a rule the format invited you to write that did exactly
nothing. Announcing every finger is the right default anyway: a session agent
should not need a root-owned file to declare its interest in a signal it is
free to ignore. The column is gone.

Which leaves the config for the two things that really do need the daemon, and
with `session` gone the verdict column had no partner left to vary against. It
read as a property of the finger while being a property of the attempt, so it
is now written as what it is:

    <finger>  [no-unlock]  [absolute command...]

no-unlock says the finger never unlocks; a command is what root runs. At least
one is required, because a finger listed alone says nothing the signal does not
already say -- and that is a parse error rather than a silently useless line.

The example config now also states plainly what no-unlock is not. It is a panic
button, not deniability: the rejection it fabricates comes back in milliseconds
where a real one takes about three seconds, the journal records that the finger
actually matched, the file names the finger in plain text, and the finger still
shows as enrolled. Both of those weaknesses are real and neither is fixed here.
This commit is contained in:
Jorijn van der Graaf 2026-09-05 05:23:40 +02:00
commit 93d7f96a63
5 changed files with 180 additions and 197 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packaging/APKBUILD
View file

@ -10,7 +10,7 @@
# Alpine, so an APKBUILD that compiled from source could not be built by
# anyone but us either.
pkgname=fingerprintd
pkgver=0.2.0
pkgver=0.2.1
pkgrel=0
pkgdesc="Fingerprint daemon for the Fairphone 6 (FocalTech FT9391 behind QTEE)"
url="https://forgejo.catcrafts.net/Catcrafts/fingerprintd"

88
packaging/actions.conf.example
View file

@ -1,12 +1,25 @@
# fingerprintd — per-finger actions.
#
# Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
# exactly what it always did: it unlocks, and nothing else happens.
# exactly what it always did: it unlocks.
#
# THIS FILE IS A ROOT SHELL. Every `system` line is a command root runs when
# that finger touches the sensor, so anything able to write this file owns the
# machine at the next press. fingerprintd refuses the whole file — not just the
# offending line — unless root owns it and no one else can write it:
# YOU PROBABLY DO NOT NEED THIS FILE. Every matched finger is already
# announced on the system bus, unconditionally and with nothing configured:
#
# net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
# on /net/reactivated/Fprint/Device/0
#
# That is how a finger launches an application. An agent in your own session
# hears the signal and decides what the finger means, from your own
# configuration, running as you with your bus and your display. The daemon is
# root and deliberately does not try to do that for you.
#
# This file is for the two things that do need the daemon.
#
# THIS FILE IS A ROOT SHELL. Every command here is run by root when that
# finger touches the sensor, so anything able to write it owns the machine at
# the next press. fingerprintd refuses the whole file — not just the offending
# line — unless root owns it and no one else can write it:
#
# sudo install -Dm644 -o root -g root actions.conf.example \
# /etc/fingerprintd/actions.conf
@ -14,48 +27,43 @@
# It is read once, at startup. Editing it means restarting the unit, which is
# also when you get to see the parse errors.
#
# Format, four fields:
# Format:
#
# <finger> <where> <verdict> <command...>
# <finger> [no-unlock] [absolute command...]
#
# finger an fprintd finger name: left-thumb, left-index-finger,
# left-middle-finger, left-ring-finger, left-little-finger, and
# the right-* equivalents.
# finger an fprintd finger name: left-thumb, left-index-finger,
# left-middle-finger, left-ring-finger, left-little-finger, and
# the right-* equivalents.
#
# where system root runs the command below.
# session no command here. The daemon emits
# net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
# and an agent in your session decides what it means.
# This is how you launch an application: root has no
# session bus and no display, and running your software
# as root to get one would be a poor trade.
# no-unlock this finger never unlocks. The client is told it did not match,
# whatever really happened.
#
# verdict match the client is told the finger matched. Normal.
# no-match the client is told it did NOT, whatever really
# happened, while the action runs anyway.
# command an ABSOLUTE path, passed to /bin/sh -c with a fixed environment
# plus FINGERPRINTD_FINGER. Double-forked, so it may outlive the
# daemon and can never delay an unlock.
#
# command an ABSOLUTE path, required for system, forbidden for session.
# It is passed to /bin/sh -c with a fixed environment plus
# FINGERPRINTD_FINGER. It is double-forked, so it may outlive the
# daemon and will never delay an unlock.
#
# A finger with no line here is untouched.
# At least one of the two is required. A finger listed on its own says nothing
# the signal above does not already say.
# --- Launching things in your session -----------------------------------
# The daemon only announces the finger; your agent maps it to an app.
#right-ring-finger session match
# --- A finger that also does something, as root -----------------------------
#right-ring-finger /usr/local/bin/toggle-something
# --- A duress finger ------------------------------------------------------
# The phone reports that it did not recognise this finger, and runs the
# script anyway. Think carefully before making that script destructive:
# --- A finger that does not unlock ------------------------------------------
#left-thumb no-unlock
# --- A duress finger: rejected, and the script runs anyway ------------------
#
# Think carefully before making that script destructive:
#
# * a false accept that opens a camera is a shrug; one that wipes is not,
# * and anyone who can compel one unlock can usually compel a second, so
# this is a panic button, not protection for data at rest. Only
# encryption is that, and by unlock time your session is already
# decrypted in RAM.
# * and anyone who can compel one unlock can usually compel a second.
#
#left-little-finger system no-match /etc/fingerprintd/panic.sh
# --- Something harmless to try it with ------------------------------------
#left-thumb system match /usr/bin/logger -t fingerprintd "thumb"
# AND KNOW WHAT THIS IS NOT. It is a panic button, not deniability. The
# rejection it fabricates is far faster than a real one — a finger the sensor
# genuinely does not know takes about three seconds to be refused, this takes
# milliseconds — the daemon's journal records that the finger really matched,
# this file names it in plain text, and the finger still shows as enrolled in
# fprintd-list. It reliably runs your script. It does not reliably hide that
# it did.
#
#left-little-finger no-unlock /etc/fingerprintd/panic.sh