The trustlet has always reported WHICH finger matched and the daemon only ever used it to answer yes. A table in /etc/fingerprintd/actions.conf now gives each finger a meaning: run a command as root, tell the user's session, or report no-match while doing one of those anyway -- which is duress, where the phone should look like it simply did not recognise the finger. Two rules shaped the design. Root does not launch applications. The daemon has no session bus, no display and no user environment, so a `session` rule carries no command at all: the daemon emits net.catcrafts.Fingerprintd1.FingerMatched(finger, uid) and an agent in the user's own session decides what that means from the user's own configuration. The only commands in the file are ones root is meant to run. Which makes the file a root shell, and the parser treats it as one. It is refused outright unless root owns it and nobody else can write it, group included. A malformed line rejects the WHOLE file rather than being skipped: applying the prefix would leave a policy nobody wrote, and the missing half could be the one that mattered. That property is tested, and the test caught it being false the first time -- rules accumulated before the bad line survived the rejection. A system command must be an absolute path, because resolving a bare name through PATH makes what root runs depend on an environment this daemon does not control. It is double-forked with a scrubbed environment so an action may outlive the daemon (a reboot) without ever stalling the worker thread that is the only thread allowed to touch the trustlet. Ordering is deliberate: the verdict override happens before the client is told, because that is the point of duress; the session signal and the root command happen after, on the same principle that keeps the harvest and the save off the unlock path. No actions.conf ships. An example goes to /usr/share/doc, because shipping a root shell nobody asked for is not a default. Not yet exercised on hardware.
139 lines
5.9 KiB
C++
139 lines
5.9 KiB
C++
// SPDX-License-Identifier: GPL-3.0-only
|
|
// SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
|
|
|
// lint-disable-file no-char-pointer
|
|
import std;
|
|
import Crafter.Build;
|
|
#include "lint-rules.h"
|
|
namespace fs = std::filesystem;
|
|
using namespace Crafter;
|
|
|
|
// libqcomtee — Qualcomm's BSD-3 userspace client for QTEE, built by
|
|
// packaging/make-libqcomtee.sh into a per-target cache dir. It is not vendored
|
|
// here: it is upstream code we pin, and the script builds it WITHOUT QCBOR
|
|
// (see the script for why that dependency is avoidable).
|
|
static void ApplyQcomteeFlags(Configuration& cfg) {
|
|
fs::path base = fs::path(std::getenv("HOME") ? std::getenv("HOME") : ".")
|
|
/ ".cache" / "fingerprintd";
|
|
// make-libqcomtee.sh names its output dir after --target, and plain
|
|
// "libqcomtee" when built for the host. cfg.target is always populated
|
|
// (it defaults to the host triple), so try the target-specific dir first
|
|
// and fall back to the host one.
|
|
std::error_code ec;
|
|
fs::path root = base / ("libqcomtee-" + cfg.target);
|
|
if (!fs::exists(root / "libqcomtee.a", ec))
|
|
root = base / "libqcomtee";
|
|
|
|
if (!fs::exists(root / "libqcomtee.a", ec)) {
|
|
std::println(std::cerr,
|
|
"libqcomtee not built for '{}'. Run:\n"
|
|
" packaging/make-libqcomtee.sh{}{}",
|
|
cfg.target.empty() ? std::string("native") : cfg.target,
|
|
cfg.target.empty() ? std::string() : " --target=" + cfg.target,
|
|
cfg.sysroot.empty() ? std::string() : " --sysroot=" + cfg.sysroot);
|
|
}
|
|
cfg.compileFlags.push_back("-I" + (root / "include").string());
|
|
cfg.linkFlags.push_back((root / "libqcomtee.a").string());
|
|
}
|
|
|
|
// pkg-config wrapper (std-only: no popen in import std). Returns the flags
|
|
// split on whitespace, or empty if pkg-config is unavailable.
|
|
static std::vector<std::string> PkgConfig(std::string_view args) {
|
|
fs::path tmp = fs::temp_directory_path() /
|
|
std::format("fingerprintd-pkgconfig-{}.txt", std::hash<std::string_view>{}(args));
|
|
std::string cmd = std::format("pkg-config {} > {} 2>/dev/null", args, tmp.string());
|
|
std::vector<std::string> flags;
|
|
if (std::system(cmd.c_str()) == 0) {
|
|
std::ifstream f(tmp);
|
|
std::string flag;
|
|
while (f >> flag)
|
|
flags.push_back(flag);
|
|
}
|
|
std::error_code ec;
|
|
fs::remove(tmp, ec);
|
|
return flags;
|
|
}
|
|
|
|
// GDBus (gio-2.0) for net.reactivated.Fprint. Same choice imsd made, for the
|
|
// same reason: the platform stack is GLib, so a GMainLoop is wanted regardless.
|
|
static void ApplyGioFlags(Configuration& cfg) {
|
|
if (!cfg.sysroot.empty()) {
|
|
// Cross build: the host's pkg-config would answer for the wrong
|
|
// architecture. glib's include layout is stable; `-I=` resolves
|
|
// inside the sysroot.
|
|
cfg.compileFlags.push_back("-I=/usr/include/glib-2.0");
|
|
cfg.compileFlags.push_back("-I=/usr/lib/glib-2.0/include");
|
|
for (const char* l : { "-lgio-2.0", "-lgobject-2.0", "-lglib-2.0" })
|
|
cfg.linkFlags.push_back(l);
|
|
} else {
|
|
for (std::string& f : PkgConfig("--cflags gio-2.0"))
|
|
if (f.starts_with("-I") || f.starts_with("-D")) cfg.compileFlags.push_back(std::move(f));
|
|
std::vector<std::string> libs;
|
|
for (std::string& f : PkgConfig("--libs gio-2.0"))
|
|
if (f.starts_with("-l") || f.starts_with("-L")) libs.push_back(std::move(f));
|
|
if (libs.empty()) libs = { "-lgio-2.0", "-lgobject-2.0", "-lglib-2.0" };
|
|
for (std::string& f : libs)
|
|
cfg.linkFlags.push_back(std::move(f));
|
|
}
|
|
}
|
|
|
|
extern "C" Configuration CrafterBuildProject(std::span<const std::string_view> args) {
|
|
// fingerprintd-core — the wire formats and state machines as a static
|
|
// library of pure C++ modules. Deliberately free of GLib, libqcomtee and
|
|
// every system header: the byte-level decisions in here were the whole
|
|
// cost of this project, so they are pinned by tests that run on a dev box
|
|
// with no phone, no TEE and no sensor.
|
|
static auto Core = std::make_unique<Configuration>();
|
|
Core->path = "./";
|
|
Core->name = "fingerprintd-core";
|
|
Core->outputName = "fingerprintd-core";
|
|
ApplyStandardArgs(*Core, args);
|
|
Core->type = ConfigurationType::LibraryStatic;
|
|
{
|
|
std::array<fs::path, 9> ifaces = {
|
|
"interfaces/Fingerprintd",
|
|
"interfaces/Fingerprintd-Sfs",
|
|
"interfaces/Fingerprintd-Rpmb",
|
|
"interfaces/Fingerprintd-Ta",
|
|
"interfaces/Fingerprintd-Engine",
|
|
"interfaces/Fingerprintd-Store",
|
|
"interfaces/Fingerprintd-Tee",
|
|
"interfaces/Fingerprintd-Sensor",
|
|
"interfaces/Fingerprintd-Actions",
|
|
};
|
|
std::array<fs::path, 0> impls = {};
|
|
Core->GetInterfacesAndImplementations(ifaces, impls);
|
|
}
|
|
|
|
// fingerprintd — the daemon: sensor rail, QTEE session, the gpfile and
|
|
// RPMB listeners, and the bus surface, wrapped around the core.
|
|
Configuration cfg;
|
|
cfg.path = "./";
|
|
cfg.name = "fingerprintd";
|
|
cfg.outputName = "fingerprintd";
|
|
ApplyStandardArgs(cfg, args);
|
|
cfg.type = ConfigurationType::Executable;
|
|
cfg.dependencies = { Core.get() };
|
|
{
|
|
std::array<fs::path, 0> ifaces = {};
|
|
std::array<fs::path, 1> impls = { "implementations/main" };
|
|
cfg.GetInterfacesAndImplementations(ifaces, impls);
|
|
}
|
|
|
|
ApplyQcomteeFlags(cfg);
|
|
ApplyGioFlags(cfg);
|
|
cfg.linkFlags.push_back("-lpthread"); // the supplicant and worker threads
|
|
|
|
cfg.AddTest("Sfs").Dependencies({ Core.get() });
|
|
cfg.AddTest("Rpmb").Dependencies({ Core.get() });
|
|
cfg.AddTest("Ta").Dependencies({ Core.get() });
|
|
cfg.AddTest("Engine").Dependencies({ Core.get() });
|
|
cfg.AddTest("Store").Dependencies({ Core.get() });
|
|
cfg.AddTest("Tee").Dependencies({ Core.get() });
|
|
cfg.AddTest("Sensor").Dependencies({ Core.get() });
|
|
cfg.AddTest("Actions").Dependencies({ Core.get() });
|
|
|
|
ProjectLint::AddProjectLintRules(cfg);
|
|
|
|
return cfg;
|
|
}
|