# fingerprintd — per-finger actions.
#
# Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
# exactly what it always did: it unlocks.
#
# YOU PROBABLY DO NOT NEED THIS FILE. Every matched finger is already
# announced on the system bus, unconditionally and with nothing configured:
#
#     net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
#     on /net/reactivated/Fprint/Device/0
#
# That is how a finger launches an application. An agent in your own session
# hears the signal and decides what the finger means, from your own
# configuration, running as you with your bus and your display. The daemon is
# root and deliberately does not try to do that for you.
#
# This file is for the two things that do need the daemon.
#
# THIS FILE IS A ROOT SHELL. Every command here is run by root when that
# finger touches the sensor, so anything able to write it owns the machine at
# the next press. fingerprintd refuses the whole file — not just the offending
# line — unless root owns it and no one else can write it:
#
#     sudo install -Dm644 -o root -g root actions.conf.example \
#          /etc/fingerprintd/actions.conf
#
# It is read once, at startup. Editing it means restarting the unit, which is
# also when you get to see the parse errors.
#
# Format:
#
#   <finger>  [no-unlock]  [absolute command...]
#
#   finger     an fprintd finger name: left-thumb, left-index-finger,
#              left-middle-finger, left-ring-finger, left-little-finger, and
#              the right-* equivalents.
#
#   no-unlock  this finger never unlocks. The client is told it did not match,
#              whatever really happened.
#
#   command    an ABSOLUTE path, passed to /bin/sh -c with a fixed environment
#              plus FINGERPRINTD_FINGER. Double-forked, so it may outlive the
#              daemon and can never delay an unlock.
#
# At least one of the two is required. A finger listed on its own says nothing
# the signal above does not already say.

# --- A finger that also does something, as root -----------------------------
#right-ring-finger    /usr/local/bin/toggle-something

# --- A finger that does not unlock ------------------------------------------
#left-thumb           no-unlock

# --- A duress finger: rejected, and the script runs anyway ------------------
#
# Think carefully before making that script destructive:
#
#   * a false accept that opens a camera is a shrug; one that wipes is not,
#   * and anyone who can compel one unlock can usually compel a second.
#
# AND KNOW WHAT THIS IS NOT. It is a panic button, not deniability. The
# rejection it fabricates is far faster than a real one — a finger the sensor
# genuinely does not know takes about three seconds to be refused, this takes
# milliseconds — the daemon's journal records that the finger really matched,
# this file names it in plain text, and the finger still shows as enrolled in
# fprintd-list. It reliably runs your script. It does not reliably hide that
# it did.
#
#left-little-finger   no-unlock  /etc/fingerprintd/panic.sh