Catcrafts/fingerprintd
Watch
2
0
Fork
You've already forked fingerprintd
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ship postlogin too, the other half of the seam kscreenlocker expects

Browse source 
fingerprint-auth alone was not enough. /etc/pam.d/kde-fingerprint is written
for a Fedora/authselect layout and its auth stack is two lines: a substack of
fingerprint-auth followed by an include of postlogin. Alpine ships neither.

With only the first supplied, the fingerprint MATCHED and PAM still answered
Permission denied -- the include of a missing service failing after the match
had already succeeded, which is a confusing way to be told a file is absent.
The daemon's own log said MATCH while pamtester said no.

On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs
that; what is needed is that the seam exists and contributes nothing, so the
stack's result stays the one the fingerprint substack produced. Hence four
optional pam_permit lines and a comment explaining why it is deliberately
empty rather than merely unfinished.

Also observed while testing, and worth knowing before anyone calls this
broken: the lock screen arms fingerprint ONCE when it appears, waits 30
seconds -- pam_fprintd's own timeout -- and then cancels and falls back to a
password. Pressing outside that window reaches nothing at all, and the daemon
records it as `verify: cancelled over 0 press(es)`.
This commit is contained in:
Jorijn van der Graaf 2026-09-05 05:56:47 +02:00
commit fd244238d0
4 changed files with 33 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

28
packaging/postlogin.pam Normal file
View file

@ -0,0 +1,28 @@
#%PAM-1.0
# SPDX-License-Identifier: GPL-3.0-only
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
#
# The second service kscreenlocker names and Alpine does not provide.
#
# /etc/pam.d/kde-fingerprint is written for a Fedora/authselect layout. Its
# auth stack is:
#
# auth substack fingerprint-auth
# auth include postlogin
#
# Neither file exists on Alpine. With only the first supplied, a fingerprint
# that MATCHED still came back as "Permission denied", because the include of
# a missing service fails after the match has already succeeded -- which is a
# confusing way to be told a file is absent.
#
# On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs
# that. What is needed is that the seam exists and contributes nothing, so the
# result of the stack stays the one the fingerprint substack produced.
#
# Vendor directory, so an administrator can still override it in /etc/pam.d.
# Shipped here for the same reason as fingerprint-auth: this package is what
# makes the fingerprint half of that stack mean anything.
auth optional pam_permit.so
account optional pam_permit.so
password optional pam_permit.so
session optional pam_permit.so