Jorijn van der Graaf
93d7f96a63
Jorijn caught both.
`session` declared nothing. The FingerMatched signal is emitted for every
matched finger unconditionally -- it never consulted the config -- so a
`session` line was a rule the format invited you to write that did exactly
nothing. Announcing every finger is the right default anyway: a session agent
should not need a root-owned file to declare its interest in a signal it is
free to ignore. The column is gone.
Which leaves the config for the two things that really do need the daemon, and
with `session` gone the verdict column had no partner left to vary against. It
read as a property of the finger while being a property of the attempt, so it
is now written as what it is:
<finger> [no-unlock] [absolute command...]
no-unlock says the finger never unlocks; a command is what root runs. At least
one is required, because a finger listed alone says nothing the signal does not
already say -- and that is a parse error rather than a silently useless line.
The example config now also states plainly what no-unlock is not. It is a panic
button, not deniability: the rejection it fabricates comes back in milliseconds
where a real one takes about three seconds, the journal records that the finger
actually matched, the file names the finger in plain text, and the finger still
shows as enrolled. Both of those weaknesses are real and neither is fixed here.
69 lines
3 KiB
Text
69 lines
3 KiB
Text
# fingerprintd — per-finger actions.
|
|
#
|
|
# Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
|
|
# exactly what it always did: it unlocks.
|
|
#
|
|
# YOU PROBABLY DO NOT NEED THIS FILE. Every matched finger is already
|
|
# announced on the system bus, unconditionally and with nothing configured:
|
|
#
|
|
# net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
|
|
# on /net/reactivated/Fprint/Device/0
|
|
#
|
|
# That is how a finger launches an application. An agent in your own session
|
|
# hears the signal and decides what the finger means, from your own
|
|
# configuration, running as you with your bus and your display. The daemon is
|
|
# root and deliberately does not try to do that for you.
|
|
#
|
|
# This file is for the two things that do need the daemon.
|
|
#
|
|
# THIS FILE IS A ROOT SHELL. Every command here is run by root when that
|
|
# finger touches the sensor, so anything able to write it owns the machine at
|
|
# the next press. fingerprintd refuses the whole file — not just the offending
|
|
# line — unless root owns it and no one else can write it:
|
|
#
|
|
# sudo install -Dm644 -o root -g root actions.conf.example \
|
|
# /etc/fingerprintd/actions.conf
|
|
#
|
|
# It is read once, at startup. Editing it means restarting the unit, which is
|
|
# also when you get to see the parse errors.
|
|
#
|
|
# Format:
|
|
#
|
|
# <finger> [no-unlock] [absolute command...]
|
|
#
|
|
# finger an fprintd finger name: left-thumb, left-index-finger,
|
|
# left-middle-finger, left-ring-finger, left-little-finger, and
|
|
# the right-* equivalents.
|
|
#
|
|
# no-unlock this finger never unlocks. The client is told it did not match,
|
|
# whatever really happened.
|
|
#
|
|
# command an ABSOLUTE path, passed to /bin/sh -c with a fixed environment
|
|
# plus FINGERPRINTD_FINGER. Double-forked, so it may outlive the
|
|
# daemon and can never delay an unlock.
|
|
#
|
|
# At least one of the two is required. A finger listed on its own says nothing
|
|
# the signal above does not already say.
|
|
|
|
# --- A finger that also does something, as root -----------------------------
|
|
#right-ring-finger /usr/local/bin/toggle-something
|
|
|
|
# --- A finger that does not unlock ------------------------------------------
|
|
#left-thumb no-unlock
|
|
|
|
# --- A duress finger: rejected, and the script runs anyway ------------------
|
|
#
|
|
# Think carefully before making that script destructive:
|
|
#
|
|
# * a false accept that opens a camera is a shrug; one that wipes is not,
|
|
# * and anyone who can compel one unlock can usually compel a second.
|
|
#
|
|
# AND KNOW WHAT THIS IS NOT. It is a panic button, not deniability. The
|
|
# rejection it fabricates is far faster than a real one — a finger the sensor
|
|
# genuinely does not know takes about three seconds to be refused, this takes
|
|
# milliseconds — the daemon's journal records that the finger really matched,
|
|
# this file names it in plain text, and the finger still shows as enrolled in
|
|
# fprintd-list. It reliably runs your script. It does not reliably hide that
|
|
# it did.
|
|
#
|
|
#left-little-finger no-unlock /etc/fingerprintd/panic.sh
|