# fingerprintd — per-finger actions.
#
# Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
# exactly what it always did: it unlocks, and nothing else happens.
#
# THIS FILE IS A ROOT SHELL. Every `system` line is a command root runs when
# that finger touches the sensor, so anything able to write this file owns the
# machine at the next press. fingerprintd refuses the whole file — not just the
# offending line — unless root owns it and no one else can write it:
#
#     sudo install -Dm644 -o root -g root actions.conf.example \
#          /etc/fingerprintd/actions.conf
#
# It is read once, at startup. Editing it means restarting the unit, which is
# also when you get to see the parse errors.
#
# Format, four fields:
#
#   <finger>  <where>  <verdict>  <command...>
#
#   finger    an fprintd finger name: left-thumb, left-index-finger,
#             left-middle-finger, left-ring-finger, left-little-finger, and
#             the right-* equivalents.
#
#   where     system   root runs the command below.
#             session  no command here. The daemon emits
#                      net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
#                      and an agent in your session decides what it means.
#                      This is how you launch an application: root has no
#                      session bus and no display, and running your software
#                      as root to get one would be a poor trade.
#
#   verdict   match     the client is told the finger matched. Normal.
#             no-match  the client is told it did NOT, whatever really
#                       happened, while the action runs anyway.
#
#   command   an ABSOLUTE path, required for system, forbidden for session.
#             It is passed to /bin/sh -c with a fixed environment plus
#             FINGERPRINTD_FINGER. It is double-forked, so it may outlive the
#             daemon and will never delay an unlock.
#
# A finger with no line here is untouched.

# --- Launching things in your session -----------------------------------
# The daemon only announces the finger; your agent maps it to an app.
#right-ring-finger    session  match

# --- A duress finger ------------------------------------------------------
# The phone reports that it did not recognise this finger, and runs the
# script anyway. Think carefully before making that script destructive:
#
#   * a false accept that opens a camera is a shrug; one that wipes is not,
#   * and anyone who can compel one unlock can usually compel a second, so
#     this is a panic button, not protection for data at rest. Only
#     encryption is that, and by unlock time your session is already
#     decrypted in RAM.
#
#left-little-finger   system   no-match  /etc/fingerprintd/panic.sh

# --- Something harmless to try it with ------------------------------------
#left-thumb           system   match     /usr/bin/logger -t fingerprintd "thumb"