52 lines
2.2 KiB
Text
52 lines
2.2 KiB
Text
# fingerprintd per-finger actions.
|
|
#
|
|
# Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
|
|
# exactly what it always did: it unlocks.
|
|
#
|
|
# This file is for running root scripts on finger actions.
|
|
# For scripts that run in your session, you can use this D-Bus:
|
|
#
|
|
# net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
|
|
# on /net/reactivated/Fprint/Device/0
|
|
#
|
|
# This file is for the two things that do need the daemon.
|
|
#
|
|
# THIS FILE IS A ROOT SHELL. Every command here is run by root when that
|
|
# finger touches the sensor, so anything able to write it owns the machine at
|
|
# the next press. fingerprintd refuses the whole file — not just the offending
|
|
# line — unless root owns it and no one else can write it:
|
|
#
|
|
# sudo install -Dm644 -o root -g root actions.conf.example \
|
|
# /etc/fingerprintd/actions.conf
|
|
#
|
|
# It is read once, at startup. Editing it means restarting the unit, which is
|
|
# also when you get to see the parse errors.
|
|
#
|
|
# Format:
|
|
#
|
|
# <finger> [no-unlock] [absolute command...]
|
|
#
|
|
# finger an fprintd finger name: left-thumb, left-index-finger,
|
|
# left-middle-finger, left-ring-finger, left-little-finger, and
|
|
# the right-* equivalents.
|
|
#
|
|
# no-unlock this finger never unlocks. The client is told it did not match,
|
|
# whatever really happened.
|
|
#
|
|
# command an absolute path, passed to /bin/sh -c with a fixed environment
|
|
# plus FINGERPRINTD_FINGER.
|
|
#
|
|
# --- A finger that also does something, as root -----------------------------
|
|
#right-ring-finger /usr/local/bin/toggle-something
|
|
#
|
|
# --- A duress finger: rejected, and the script runs anyway ------------------
|
|
#
|
|
# Know what this is not: It is a panic button, not deniability. The
|
|
# rejection it fabricates is far faster than a real one. A finger the sensor
|
|
# genuinely does not know takes about three seconds to be refused, this takes
|
|
# milliseconds. The daemon's journal records that the finger really matched,
|
|
# this file names it in plain text, and the finger still shows as enrolled in
|
|
# fprintd-list. It reliably runs your script. It does not reliably hide that
|
|
# it did.
|
|
#
|
|
#left-little-finger no-unlock /etc/fingerprintd/panic.sh
|