Jorijn van der Graaf
1934822554
The daemon announces every matched finger on the system bus and stops there, because root has no session bus, no display and no business starting your applications. fingerprintd-agent is the other half: it runs as you, subscribes properly rather than parsing gdbus monitor output, filters by uid because the signal is visible to every local user, and maps fingers to commands from a file you own and can edit without restarting anything. It is a separate binary and a separate subpackage because it is a separate trust domain. /etc/fingerprintd/actions.conf is a root shell and is guarded like one; ~/.config/fingerprintd/fingers.conf runs your commands as you, so it is an ordinary dotfile. Demonstrated on the phone: one press of the unlock finger both unlocks it and opens plasma-camera.
40 lines
2 KiB
Text
40 lines
2 KiB
Text
#%PAM-1.0
|
|
# SPDX-License-Identifier: GPL-3.0-only
|
|
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
|
#
|
|
# The service kscreenlocker's /etc/pam.d/kde-fingerprint substacks, and which
|
|
# nothing on Alpine provides -- so on a stock pmOS image every fingerprint
|
|
# unlock fails before it reaches any daemon, with PAM unable to open the
|
|
# substack rather than anything about fingerprints. kscreenlocker ships
|
|
# kde-fingerprint (auth/account/password/session all `include fingerprint-auth`)
|
|
# and Alpine ships pam_fprintd, and the file joining them is simply absent.
|
|
#
|
|
# It lives in the vendor directory /usr/lib/pam.d, next to Alpine's own
|
|
# base-auth, so an administrator can still override it in /etc/pam.d.
|
|
#
|
|
# fingerprintd ships it because fingerprintd is what makes it mean anything:
|
|
# this package provides fprintd, so it owns the bus name pam_fprintd talks to.
|
|
|
|
# pam_fprintd asks the daemon to verify, prompting through the PAM
|
|
# conversation; sufficient, so a match ends the stack successfully and a
|
|
# failure falls through to pam_deny rather than to a password -- the caller
|
|
# (kde-fingerprint) is the one that decides whether to offer a password next.
|
|
# timeout: pam_fprintd defaults to 30 seconds and the lock screen arms
|
|
# fingerprint exactly ONCE when it appears, so on a stock setup the sensor is
|
|
# live for half a minute and then silently is not -- a press after that reaches
|
|
# nothing at all, which reads as a broken sensor rather than an expired window.
|
|
# 60 s is a compromise, not a fix: every second of it is our verify loop
|
|
# polling the trustlet at ~5 Hz, so the honest ceiling on this number is set by
|
|
# the idle-IRQ work (fp6 journal/fingerprint, "SENSOR POWER"). Raise it once an
|
|
# idle verify costs nothing.
|
|
auth required pam_env.so
|
|
auth sufficient pam_fprintd.so timeout=60
|
|
auth required pam_deny.so
|
|
|
|
account include base-account
|
|
|
|
# A fingerprint cannot set a password, and kde-fingerprint includes this
|
|
# service for `password` as well.
|
|
password required pam_deny.so
|
|
|
|
session include base-session
|