Jorijn van der Graaf
905e261d63
An aport, the units, and everything a phone needs to come up with a working sensor without a single command being run by hand. Verified on the dev phone across two reboots: modules-load.d loads qcomtee, tmpfiles builds the SFS root, the mount unit brings up persist, and the daemon is ready 51 seconds into the boot, owning net.reactivated.Fprint with the enrolled finger visible. The packaging shape is the one imsd uses for 81voltd. A versioned provides="fprintd=..." satisfies plasma-workspace -- its Users KCM is the enrolment UI and speaks exactly this bus name -- and excludes the real fprintd, which is not tidiness: fprintd is D-Bus-activatable, so a client call would otherwise start it and fight us for the name. The cost is the fprintd-* CLIs, which go with the package. fprintd-pam is an install_if subpackage pinned to the exact fprintd version, so the provides breaks its condition and apk purges it -- taking pam_fprintd, which is the entire point of the daemon, with it. Depending on it explicitly is what keeps it, and it has no dependency on fprintd itself. Two things the packaging exposed in the daemon: The transcript is for experiments, not for a shipped daemon. A file per start in an unrotated directory, recording the time of every unlock, to say what the journal already has. It is now opt-in behind --log-dir, which is what deploy-dev.sh passes since fplearn.sh reads it. Taking it off the daemon path also took away the setvbuf it was doing as a side effect of dup2'ing fd 1, and under systemd stdout is a pipe, which means full buffering: the daemon started, worked, answered D-Bus calls, and printed nothing. A working daemon that looks hung. stdout is now line-buffered from the first line of main. The config ships as generated by fp6fpcfg.py --daemon --verbose, sha256 b205c756914a66f1, because that is the file every accuracy number was measured on. The quieter variant is untested and switching is a measurement. The trustlet is not here and never will be: focal64.mbn is a proprietary OEM-signed blob, and the unit's ConditionPathExists is what keeps the package inert without it -- as it does on a kernel with no CONFIG_QCOMTEE.
53 lines
2.3 KiB
XML
53 lines
2.3 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN" "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
|
|
<!-- SPDX-License-Identifier: GPL-3.0-only
|
|
SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
|
|
|
fingerprintd owns net.reactivated.Fprint, which excludes the fprintd
|
|
package and the actions file it ships. These are the same three action
|
|
ids with the same defaults, so a client that consults them — or a site
|
|
that has already written rules against them — sees no change.
|
|
|
|
NOT YET ENFORCED. The daemon currently authorizes by caller uid: a
|
|
client may act on its own prints and no other user's. That is stricter
|
|
than allow_active=yes for verify and LOOSER than auth_self_keep for
|
|
enroll, which asks the user to re-authenticate first. Enforcing these
|
|
needs a polkit agent to be reachable, and the FP6 does not have a
|
|
working session UI yet, so it would today block enrolment on the one
|
|
device that can test it. Tracked in the fp6 journal's fingerprint lane.
|
|
Install: /usr/share/polkit-1/actions/ -->
|
|
<policyconfig>
|
|
<vendor>Catcrafts</vendor>
|
|
<vendor_url>https://forgejo.catcrafts.net/Catcrafts/fingerprintd</vendor_url>
|
|
<icon_name>fingerprint</icon_name>
|
|
|
|
<action id="net.reactivated.fprint.device.verify">
|
|
<description>Verify a fingerprint</description>
|
|
<message>Privileges are required to verify fingerprints.</message>
|
|
<defaults>
|
|
<allow_any>no</allow_any>
|
|
<allow_inactive>no</allow_inactive>
|
|
<allow_active>yes</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="net.reactivated.fprint.device.enroll">
|
|
<description>Enroll new fingerprints</description>
|
|
<message>Privileges are required to enroll new fingerprints.</message>
|
|
<defaults>
|
|
<allow_any>no</allow_any>
|
|
<allow_inactive>no</allow_inactive>
|
|
<allow_active>auth_self_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
|
|
<action id="net.reactivated.fprint.device.setusername">
|
|
<description>Select a user to enroll</description>
|
|
<message>Privileges are required to select a user to enroll.</message>
|
|
<defaults>
|
|
<allow_any>no</allow_any>
|
|
<allow_inactive>no</allow_inactive>
|
|
<allow_active>auth_admin_keep</allow_active>
|
|
</defaults>
|
|
</action>
|
|
</policyconfig>
|