Jorijn van der Graaf
fd244238d0
fingerprint-auth alone was not enough. /etc/pam.d/kde-fingerprint is written for a Fedora/authselect layout and its auth stack is two lines: a substack of fingerprint-auth followed by an include of postlogin. Alpine ships neither. With only the first supplied, the fingerprint MATCHED and PAM still answered Permission denied -- the include of a missing service failing after the match had already succeeded, which is a confusing way to be told a file is absent. The daemon's own log said MATCH while pamtester said no. On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs that; what is needed is that the seam exists and contributes nothing, so the stack's result stays the one the fingerprint substack produced. Hence four optional pam_permit lines and a comment explaining why it is deliberately empty rather than merely unfinished. Also observed while testing, and worth knowing before anyone calls this broken: the lock screen arms fingerprint ONCE when it appears, waits 30 seconds -- pam_fprintd's own timeout -- and then cancels and falls back to a password. Pressing outside that window reaches nothing at all, and the daemon records it as `verify: cancelled over 0 press(es)`.
28 lines
1.2 KiB
Text
28 lines
1.2 KiB
Text
#%PAM-1.0
|
|
# SPDX-License-Identifier: GPL-3.0-only
|
|
# SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®
|
|
#
|
|
# The second service kscreenlocker names and Alpine does not provide.
|
|
#
|
|
# /etc/pam.d/kde-fingerprint is written for a Fedora/authselect layout. Its
|
|
# auth stack is:
|
|
#
|
|
# auth substack fingerprint-auth
|
|
# auth include postlogin
|
|
#
|
|
# Neither file exists on Alpine. With only the first supplied, a fingerprint
|
|
# that MATCHED still came back as "Permission denied", because the include of
|
|
# a missing service fails after the match has already succeeded -- which is a
|
|
# confusing way to be told a file is absent.
|
|
#
|
|
# On Fedora postlogin does lastlog and umask bookkeeping. Nothing here needs
|
|
# that. What is needed is that the seam exists and contributes nothing, so the
|
|
# result of the stack stays the one the fingerprint substack produced.
|
|
#
|
|
# Vendor directory, so an administrator can still override it in /etc/pam.d.
|
|
# Shipped here for the same reason as fingerprint-auth: this package is what
|
|
# makes the fingerprint half of that stack mean anything.
|
|
auth optional pam_permit.so
|
|
account optional pam_permit.so
|
|
password optional pam_permit.so
|
|
session optional pam_permit.so
|