David Heinemeier HanssonandClaude Opus 4.8
e2bf0daaa8
Add a first-run notification, alongside the keybindings/Wi-Fi toasts, that invites anyone with a fingerprint sensor to enable it. Clicking launches omarchy-setup-security-fingerprint in a floating terminal. Detection lives in a new omarchy-hw-fingerprint helper that reads sysfs (device product descriptor plus a fingerprint-vendor allowlist), so it works before fprintd/usbutils are installed and without nagging machines that have no reader. The setup script reuses the same helper as an early gate, bailing before installing any packages when no reader is found (replacing the old post-install fprintd-list probe). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
106 lines
3.6 KiB
Bash
Executable File
106 lines
3.6 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Set up fingerprint authentication for sudo, polkit, and lock screen
|
|
# omarchy:requires-sudo=true
|
|
|
|
set -e
|
|
|
|
|
|
setup_pam_config() {
|
|
# Configure sudo
|
|
if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then
|
|
echo "Configuring sudo for fingerprint authentication..."
|
|
sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/sudo
|
|
fi
|
|
|
|
# Configure polkit. A clamshell gate runs before pam_fprintd: when the lid
|
|
# is shut the reader is unreachable, so it skips fingerprint (success=1) and
|
|
# PAM drops straight to the password prompt. Lid open → fingerprint, then
|
|
# password as the fallback.
|
|
#
|
|
# pam_exec needs a literal absolute path (no env expansion). Point at the
|
|
# fixed /usr/bin path the omarchy package always provides, so the gate keeps
|
|
# working across package installs and dev-link — the latter overlays
|
|
# $OMARCHY_PATH trees but leaves /usr/bin untouched.
|
|
local polkit_gate="auth [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed"
|
|
|
|
if [[ -f /etc/pam.d/polkit-1 ]]; then
|
|
if ! grep -q 'pam_fprintd.so' /etc/pam.d/polkit-1; then
|
|
echo "Configuring polkit for fingerprint authentication..."
|
|
sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/polkit-1
|
|
fi
|
|
if ! grep -q 'omarchy-hw-laptop-closed' /etc/pam.d/polkit-1; then
|
|
echo "Adding clamshell gate to polkit..."
|
|
# Insert immediately before pam_fprintd so success=1 skips exactly it.
|
|
sudo sed -i "/pam_fprintd\.so/i $polkit_gate" /etc/pam.d/polkit-1
|
|
fi
|
|
else
|
|
echo "Creating polkit configuration with fingerprint authentication..."
|
|
sudo tee /etc/pam.d/polkit-1 >/dev/null <<EOF
|
|
$polkit_gate
|
|
auth sufficient pam_fprintd.so
|
|
auth required pam_unix.so
|
|
|
|
account required pam_unix.so
|
|
password required pam_unix.so
|
|
session required pam_unix.so
|
|
EOF
|
|
fi
|
|
}
|
|
|
|
setup_lock_fingerprint_pam() {
|
|
echo "Configuring lock screen for fingerprint authentication..."
|
|
sudo tee /etc/pam.d/omarchy-lock-fingerprint >/dev/null <<'EOF'
|
|
#%PAM-1.0
|
|
auth required pam_fprintd.so
|
|
account include system-local-login
|
|
EOF
|
|
}
|
|
|
|
|
|
echo -e "\e[32mSetting up fingerprint scanner for authentication.\n\e[0m"
|
|
|
|
# Bail before installing anything if there's no reader to talk to.
|
|
if ! omarchy-hw-fingerprint; then
|
|
echo -e "\e[31mNo fingerprint sensor detected.\e[0m"
|
|
exit 1
|
|
fi
|
|
|
|
# Install required packages
|
|
echo "Installing required packages..."
|
|
|
|
installed_libfprint=$(pacman -Qq libfprint 2>/dev/null || true)
|
|
|
|
# libfprint-git provides+conflicts libfprint; pacman -S --noconfirm
|
|
# defaults the conflict prompt to N and aborts. Pre-remove the exact
|
|
# libfprint package, but not an installed provider like libfprint-git.
|
|
if [[ $installed_libfprint == "libfprint" ]]; then
|
|
sudo pacman -Rdd --noconfirm libfprint
|
|
fi
|
|
|
|
omarchy-pkg-add libfprint-git fprintd usbutils
|
|
|
|
# Configure PAM
|
|
setup_pam_config
|
|
|
|
# Enroll first fingerprint
|
|
echo -e "\e[32m\nLet's setup your right index finger as the first fingerprint.\e[0m"
|
|
echo -e "Keep moving the finger around on sensor until the process completes.\n"
|
|
|
|
if sudo fprintd-enroll "$USER"; then
|
|
echo -e "\e[32m\nFingerprint enrolled successfully!\e[0m"
|
|
|
|
# Verify
|
|
echo -e "\nNow let's verify that it's working correctly.\n"
|
|
if fprintd-verify; then
|
|
setup_lock_fingerprint_pam
|
|
echo -e "\e[32m\nPerfect! Fingerprint authentication is now configured.\e[0m"
|
|
echo "You can use your fingerprint for sudo, polkit, and lock screen (Super + Ctrl + L)."
|
|
else
|
|
echo -e "\e[31m\nVerification failed. You may want to try enrolling again.\e[0m"
|
|
fi
|
|
else
|
|
echo -e "\e[31m\nEnrollment failed. Please try again.\e[0m"
|
|
exit 1
|
|
fi
|