Jorijn van der Graaf
41e86f84f4
FF_CMD_TA_REMOVE, recovered the way AUTHENTICATE was: read the stub, read the handler. The 0x2006 stub at 0xa15c is a bare `ldp w0, w1, [payload]`, so the request is two u32s -- gid at +0, fid at +4 -- and the 0x2000 dispatcher validates no length. Walking the jump table reproduces authenticate at 0xa180, which is the address already on record, so the table read is sound. Three preconditions, all the trustlet's own. The gid must be the ACTIVE group (it compares against device+0x30, the field SET_ACTIVE_GROUP writes). The fid must be non-zero: zero is not "remove all", it is an error the trustlet logs and refuses. And the fid must be among the loaded templates, because it removes by the SLOT INDEX it finds, not by id. It persists: on a hit the trustlet formats ff_template_<gid>_<slot>.bin and calls ff_file_delete, which arrives on our gpfile listener as an unlink -- so this only works with the store served writable. Proven harmlessly first. --probe-remove sends one command with no map involvement, and a fid the group does not hold answers rc=-2 with the real template untouched -- which is what established that both words are read where we send them, before anything was deleted. Then for real, through fprintd-delete: both 347202-byte containers and their .bak companions unlinked, templates loaded 1 -> 0, and a re-enrolment afterwards completed 20 stages with SAVE_DATA rc=0, so the store is consistent after a removal rather than merely emptier. The ordering the transcript shows is worth keeping: the group index is rewritten and the RPMB anti-rollback counter bumped BEFORE each unlink. That is precisely why an orderly removal leaves a valid store where restoring an older container leaves a tampered one -- the counter has already moved past it. The delete reply now waits for the worker, because only that thread invokes the trustlet and fprintd's Delete methods are synchronous. Names are dropped before templates on purpose: a template that survives a failed removal is a slot leak, while a name that survives a successful one keeps offering a finger that can no longer match.
111 lines
5.6 KiB
Text
111 lines
5.6 KiB
Text
# SPDX-License-Identifier: GPL-3.0-only
|
|
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
|
# Maintainer: Jorijn van der Graaf <jorijnvdgraaf@catcrafts.net>
|
|
# Binary packaging: wraps a crafter-build binary cross-compiled per the
|
|
# README's "Cross-compiling" section into a proper apk — used by this repo's
|
|
# package CI (packaging/build-package.sh, which seds pkgver from
|
|
# implementations/main.cpp) and runnable by hand. The source tarball is
|
|
# produced by packaging/make-bin-tarball.sh. There is deliberately no
|
|
# source-building aport: the build driver is crafter-build, which is not in
|
|
# Alpine, so an APKBUILD that compiled from source could not be built by
|
|
# anyone but us either.
|
|
pkgname=fingerprintd
|
|
pkgver=0.1.3
|
|
pkgrel=0
|
|
pkgdesc="Fingerprint daemon for the Fairphone 6 (FocalTech FT9391 behind QTEE)"
|
|
url="https://forgejo.catcrafts.net/Catcrafts/fingerprintd"
|
|
arch="aarch64"
|
|
license="GPL-3.0-only"
|
|
# GLib for the D-Bus interface; libc++ because the binary is a clang/libc++
|
|
# C++26 modules build linked dynamically against the phone's own runtime.
|
|
#
|
|
# fprintd-pam is pam_fprintd, which is the point of the whole daemon: it is
|
|
# what turns a matched finger into a login. It is an install_if subpackage
|
|
# conditioned on the EXACT version fprintd-pam was built against
|
|
# (i:fprintd=1.94.5-r1), so the provides below breaks that condition and apk
|
|
# would purge it as no-longer-needed. Depending on it explicitly is what keeps
|
|
# it. It has no dependency on fprintd itself, so nothing is being forced.
|
|
#
|
|
# fp6-vendor-blobs runs the manifest fragment below, which reassembles the
|
|
# trustlet out of the stock modem partition on first boot. Without it there is
|
|
# no matcher and the unit stays inert on its ConditionPathExists -- so this is
|
|
# a real dependency, not a nicety. It is an FP6 device package; so is this.
|
|
depends="dbus glib libc++ fprintd-pam fp6-vendor-blobs"
|
|
# The versioned provides both satisfies plasma-workspace's fprintd dependency
|
|
# — its Users KCM is the fingerprint enrolment UI and speaks exactly this bus
|
|
# name — and EXCLUDES the real package, which is required rather than tidy:
|
|
# fprintd is D-Bus-activatable, so a client call would otherwise start the
|
|
# real daemon and fight for net.reactivated.Fprint. fprintd-pam is a separate
|
|
# package that does not depend on fprintd, so PAM keeps working.
|
|
#
|
|
# The cost, which is real: the fprintd-enroll/-list/-verify/-delete CLIs go
|
|
# away with the package. Enrolment then goes through Plasma's Users KCM.
|
|
provides="fprintd=$pkgver-r$pkgrel"
|
|
# The unit is the deliverable — a daemon holding QTEE's listener table open for
|
|
# the life of the boot is not something to start by hand — but abuild wants
|
|
# systemd files in their own package, and install_if puts them back on any
|
|
# system that has systemd. No OpenRC service: nothing here has ever been run
|
|
# under one, and the unit's conditions (the vendor blob, /dev/tee0) are what
|
|
# keep the package inert on a phone that cannot use it.
|
|
subpackages="$pkgname-systemd"
|
|
# nothing is compiled here, and the aarch64 ELF's NEEDED entries must not be
|
|
# traced against an x86_64 build host
|
|
options="!check !tracedeps"
|
|
source="fingerprintd-$pkgver.tar.gz"
|
|
|
|
package() {
|
|
cd "$srcdir/fingerprintd-$pkgver"
|
|
install -Dm755 fingerprintd "$pkgdir"/usr/bin/fingerprintd
|
|
|
|
install -Dm644 fingerprintd.service \
|
|
"$pkgdir"/usr/lib/systemd/system/fingerprintd.service
|
|
install -Dm644 mnt-persist.mount \
|
|
"$pkgdir"/usr/lib/systemd/system/mnt-persist.mount
|
|
# enabled by preset, and by an explicit .wants link so a fingerprint
|
|
# surviving a reboot never depends on a manual systemctl enable. The
|
|
# mount needs neither: fingerprintd.service pulls it in with
|
|
# RequiresMountsFor.
|
|
install -Dm644 80-fingerprintd.preset \
|
|
"$pkgdir"/usr/lib/systemd/system-preset/80-fingerprintd.preset
|
|
mkdir -p "$pkgdir"/etc/systemd/system/multi-user.target.wants
|
|
ln -s /usr/lib/systemd/system/fingerprintd.service \
|
|
"$pkgdir"/etc/systemd/system/multi-user.target.wants/fingerprintd.service
|
|
|
|
# who may own and call the bus name
|
|
install -Dm644 net.reactivated.Fprint.conf \
|
|
"$pkgdir"/usr/share/dbus-1/system.d/net.reactivated.Fprint.conf
|
|
# replaces fprintd's activation file, which points at /usr/libexec/fprintd
|
|
install -Dm644 net.reactivated.Fprint.service \
|
|
"$pkgdir"/usr/share/dbus-1/system-services/net.reactivated.Fprint.service
|
|
# the action ids fprintd defined; see the file for what enforces them
|
|
install -Dm644 net.reactivated.fprint.device.policy \
|
|
"$pkgdir"/usr/share/polkit-1/actions/net.reactivated.fprint.device.policy
|
|
|
|
# the SFS root's directories and its two symlinks into the persist mount
|
|
install -Dm644 fingerprintd.tmpfiles.conf \
|
|
"$pkgdir"/usr/lib/tmpfiles.d/fingerprintd.conf
|
|
# qcomtee -> /dev/tee0
|
|
install -Dm644 fingerprintd.modules-load.conf \
|
|
"$pkgdir"/usr/lib/modules-load.d/fingerprintd.conf
|
|
|
|
# the trustlet's configuration, generated by fp6fpcfg.py from the captured
|
|
# stock dump — see packaging/README.config.md. Not a user config file:
|
|
# the TA discards a file whose configuration_uuid does not match, and the
|
|
# two policy keys in it were each forced by a measurement.
|
|
install -Dm644 fingerprintd.json \
|
|
"$pkgdir"/usr/lib/firmware/fingerprintd.json
|
|
|
|
# the trustlet is NOT in this package and never will be: it is a
|
|
# proprietary OEM-signed blob. This tells fp6-vendor-blobs how to
|
|
# reassemble it from the phone's own stock partitions, which is the
|
|
# same mechanism soc-fairphone-fp6-audio uses for the amp config.
|
|
install -Dm644 20-focal64.manifest \
|
|
"$pkgdir"/usr/share/fp6-vendor-blobs/manifest.d/20-focal64.manifest
|
|
}
|
|
|
|
systemd() {
|
|
install_if="$pkgname=$pkgver-r$pkgrel systemd"
|
|
|
|
amove usr/lib/systemd
|
|
amove etc/systemd
|
|
}
|