From 9b03f15b4f3d715ac0c25abf2c70d37caeb43c35 Mon Sep 17 00:00:00 2001 From: Meir Dick Date: Sun, 9 Aug 2026 15:54:01 -0400 Subject: [PATCH] Detect Elan match-on-chip fingerprint readers again (#6578) * Detect Elan match-on-chip fingerprint readers again Elan readers report "ELAN:ARM-M4" as their product string, so the *fingerprint* and *biometric* checks miss them. Elan's 04f3 is also left out of the vendor list on purpose, because Elan makes touchscreens too. Both checks fail, so the machine looks like it has no reader. Add "elan:arm-m4" to the product string check. The comment above the vendor list already says the excluded vendors should still match there, so this makes that true. The vendor list and its has_kernel_driver guard are unchanged, and touchscreens still cannot cause a false positive. The string is a family name, not one device. libfprint uses it for 04f3:0c9c and 04f3:0ca7 as well as 04f3:0ca8. Tested on an HP EliteBook X G2i with 04f3:0ca8. * Point the Elan comment at the vendor list above it Co-Authored-By: Claude Opus 5 (1M context) * Configure PAM only after a fingerprint enrolls and verifies Detection proves a reader is present, not that libfprint can drive it. Elan MOC sensors outside the elanmoc table pass the gate and then fail to enroll, which left pam_fprintd in the sudo and polkit stacks with no print to match. Co-Authored-By: Claude Opus 5 (1M context) --------- Co-authored-by: David Heinemeier Hansson Co-authored-by: Claude Opus 5 (1M context) --- bin/omarchy-hw-fingerprint | 5 ++++- bin/omarchy-setup-security-fingerprint | 9 ++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/bin/omarchy-hw-fingerprint b/bin/omarchy-hw-fingerprint index c5f119d9..03af4fdb 100755 --- a/bin/omarchy-hw-fingerprint +++ b/bin/omarchy-hw-fingerprint @@ -30,7 +30,10 @@ for dev in /sys/bus/usb/devices/*; do if [[ -r $dev/product ]]; then product=$(<"$dev/product") product=${product,,} - [[ $product == *fingerprint* || $product == *biometric* ]] && exit 0 + # Elan's match-on-chip readers report "ELAN:ARM-M4", the family name + # rather than the function. Elan is left out of the vendor list above + # on purpose, so without this they match nothing. + [[ $product == *fingerprint* || $product == *biometric* || $product == *elan:arm-m4* ]] && exit 0 fi if [[ -r $dev/idVendor ]]; then diff --git a/bin/omarchy-setup-security-fingerprint b/bin/omarchy-setup-security-fingerprint index ffdbed34..dd4f428f 100755 --- a/bin/omarchy-setup-security-fingerprint +++ b/bin/omarchy-setup-security-fingerprint @@ -83,9 +83,6 @@ fi omarchy-pkg-add libfprint fprintd usbutils -# Configure PAM -setup_pam_config - # Enroll first fingerprint echo -e "\e[32m\nLet's setup your right index finger as the first fingerprint.\e[0m" echo -e "Keep moving the finger around on sensor until the process completes.\n" @@ -96,6 +93,12 @@ if sudo fprintd-enroll "$USER"; then # Verify echo -e "\nNow let's verify that it's working correctly.\n" if fprintd-verify; then + # PAM comes last, once a print is enrolled and verified. Detection only + # proves a reader is there, not that libfprint can drive it — an Elan MOC + # sensor outside the elanmoc table gets this far and then fails to enroll. + # Editing the stacks up front would leave those machines pointing at + # pam_fprintd with nothing to match. + setup_pam_config setup_lock_fingerprint_pam echo -e "\e[32m\nPerfect! Fingerprint authentication is now configured.\e[0m" echo "You can use your fingerprint for sudo, polkit, and lock screen (Super + Ctrl + L)."