# fingerprintd per-finger actions.
#
# Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
# exactly what it always did: it unlocks.
#
# This file is for running root scripts on finger actions.
# For scripts that run in your session, you can use this D-Bus:
#
#     net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
#     on /net/reactivated/Fprint/Device/0
#
# This file is for the two things that do need the daemon.
#
# THIS FILE IS A ROOT SHELL. Every command here is run by root when that
# finger touches the sensor, so anything able to write it owns the machine at
# the next press. fingerprintd refuses the whole file — not just the offending
# line — unless root owns it and no one else can write it:
#
#     sudo install -Dm644 -o root -g root actions.conf.example \
#          /etc/fingerprintd/actions.conf
#
# It is read once, at startup. Editing it means restarting the unit, which is
# also when you get to see the parse errors.
#
# Format:
#
#   <finger>  [no-unlock]  [absolute command...]
#
#   finger     an fprintd finger name: left-thumb, left-index-finger,
#              left-middle-finger, left-ring-finger, left-little-finger, and
#              the right-* equivalents.
#
#   no-unlock  this finger never unlocks. The client is told it did not match,
#              whatever really happened.
#
#   command    an absolute path, passed to /bin/sh -c with a fixed environment
#              plus FINGERPRINTD_FINGER.
#
# --- A finger that also does something, as root -----------------------------
#right-ring-finger    /usr/local/bin/toggle-something
#
# --- A duress finger: rejected, and the script runs anyway ------------------
#
# Know what this is not: It is a panic button, not deniability. The
# rejection it fabricates is far faster than a real one. A finger the sensor
# genuinely does not know takes about three seconds to be refused, this takes
# milliseconds. The daemon's journal records that the finger really matched,
# this file names it in plain text, and the finger still shows as enrolled in
# fprintd-list. It reliably runs your script. It does not reliably hide that
# it did.
#
#left-little-finger   no-unlock  /etc/fingerprintd/panic.sh