From fd244238d0048864dc26eab709e336c182c5bb70 Mon Sep 17 00:00:00 2001 From: Jorijn van der Graaf Date: Sat, 5 Sep 2026 05:56:47 +0200 Subject: [PATCH] Ship postlogin too, the other half of the seam kscreenlocker expects fingerprint-auth alone was not enough. /etc/pam.d/kde-fingerprint is written for a Fedora/authselect layout and its auth stack is two lines: a substack of fingerprint-auth followed by an include of postlogin. Alpine ships neither. With only the first supplied, the fingerprint MATCHED and PAM still answered Permission denied -- the include of a missing service failing after the match had already succeeded, which is a confusing way to be told a file is absent. The daemon's own log said MATCH while pamtester said no. On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs that; what is needed is that the seam exists and contributes nothing, so the stack's result stays the one the fingerprint substack produced. Hence four optional pam_permit lines and a comment explaining why it is deliberately empty rather than merely unfinished. Also observed while testing, and worth knowing before anyone calls this broken: the lock screen arms fingerprint ONCE when it appears, waits 30 seconds -- pam_fprintd's own timeout -- and then cancels and falls back to a password. Pressing outside that window reaches nothing at all, and the daemon records it as `verify: cancelled over 0 press(es)`. --- implementations/main.cpp | 2 +- packaging/APKBUILD | 4 +++- packaging/make-bin-tarball.sh | 1 + packaging/postlogin.pam | 28 ++++++++++++++++++++++++++++ 4 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 packaging/postlogin.pam diff --git a/implementations/main.cpp b/implementations/main.cpp index 12a7cd0..00c7eac 100644 --- a/implementations/main.cpp +++ b/implementations/main.cpp @@ -68,7 +68,7 @@ namespace { // Bumping this is what publishes a package: the registry answers 409 for a // version it already has, which a build treats as a no-op. -constexpr const char* Version = "0.2.1"; +constexpr const char* Version = "0.2.2"; bool g_verbose = false; // 500 ms was the research harness's pace, chosen so a human could read the diff --git a/packaging/APKBUILD b/packaging/APKBUILD index dcca2b0..c783055 100644 --- a/packaging/APKBUILD +++ b/packaging/APKBUILD @@ -10,7 +10,7 @@ # Alpine, so an APKBUILD that compiled from source could not be built by # anyone but us either. pkgname=fingerprintd -pkgver=0.2.1 +pkgver=0.2.2 pkgrel=0 pkgdesc="Fingerprint daemon for the Fairphone 6 (FocalTech FT9391 behind QTEE)" url="https://forgejo.catcrafts.net/Catcrafts/fingerprintd" @@ -106,6 +106,8 @@ package() { # Vendor directory, so /etc/pam.d still overrides it. install -Dm644 fingerprint-auth.pam \ "$pkgdir"/usr/lib/pam.d/fingerprint-auth + install -Dm644 postlogin.pam \ + "$pkgdir"/usr/lib/pam.d/postlogin # Documentation, not configuration: shipping an /etc/fingerprintd/ # actions.conf would be shipping a root shell nobody asked for. The diff --git a/packaging/make-bin-tarball.sh b/packaging/make-bin-tarball.sh index d7098d3..47d3eb2 100755 --- a/packaging/make-bin-tarball.sh +++ b/packaging/make-bin-tarball.sh @@ -26,6 +26,7 @@ cp packaging/fingerprintd.service \ packaging/fingerprintd.json \ packaging/20-focal64.manifest \ packaging/fingerprint-auth.pam \ + packaging/postlogin.pam \ packaging/actions.conf.example \ "$stage/fingerprintd-$VER/" tar -C "$stage" -czf "fingerprintd-$VER.tar.gz" "fingerprintd-$VER" diff --git a/packaging/postlogin.pam b/packaging/postlogin.pam new file mode 100644 index 0000000..4496ac6 --- /dev/null +++ b/packaging/postlogin.pam @@ -0,0 +1,28 @@ +#%PAM-1.0 +# SPDX-License-Identifier: GPL-3.0-only +# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts® +# +# The second service kscreenlocker names and Alpine does not provide. +# +# /etc/pam.d/kde-fingerprint is written for a Fedora/authselect layout. Its +# auth stack is: +# +# auth substack fingerprint-auth +# auth include postlogin +# +# Neither file exists on Alpine. With only the first supplied, a fingerprint +# that MATCHED still came back as "Permission denied", because the include of +# a missing service fails after the match has already succeeded -- which is a +# confusing way to be told a file is absent. +# +# On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs +# that. What is needed is that the seam exists and contributes nothing, so the +# result of the stack stays the one the fingerprint substack produced. +# +# Vendor directory, so an administrator can still override it in /etc/pam.d. +# Shipped here for the same reason as fingerprint-auth: this package is what +# makes the fingerprint half of that stack mean anything. +auth optional pam_permit.so +account optional pam_permit.so +password optional pam_permit.so +session optional pam_permit.so