David Heinemeier HanssonandClaude Opus 4.8
540e411edf
Bring the fingerprint affordance to the Quickshell lock screen and polkit dialog, matching what hyprlock did on master. Lock screen: render the md-fingerprint glyph inside the password field's right edge when a sensor is enrolled, reserving space so long passwords never run under it. Polkit dialog: show one method at a time. When a sensor is enrolled and the reader is reachable, the dialog is just the centered fingerprint icon (square card); the moment PAM asks for a password it switches to the password field. Detects pam_fprintd anywhere in the auth stack now that a gate can precede it. Lid awareness: a closed lid means the reader is unreachable, so both surfaces fall back to the password. polkit gets a pam_exec clamshell gate (auth [success=1 default=ignore] before pam_fprintd) so a shut lid drops straight to the password prompt instead of blocking on the reader for the pam_fprintd timeout; the lock screen hides the icon and skips scanning. The gate points at the fixed /usr/bin path the package always provides so it survives switching between package installs and dev-link. A migration adds the gate for existing fingerprint setups. New helper omarchy-hw-laptop-closed (pure lid state); omarchy-hw-clamshell now composes it with the external-monitor check. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
116 lines
3.8 KiB
Bash
Executable File
116 lines
3.8 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Set up fingerprint authentication for sudo, polkit, and lock screen
|
|
# omarchy:requires-sudo=true
|
|
|
|
set -e
|
|
|
|
|
|
check_fingerprint_hardware() {
|
|
# Get fingerprint devices for the user
|
|
devices=$(fprintd-list "$USER" 2>/dev/null)
|
|
|
|
# Exit if no devices found
|
|
if [[ -z $devices ]]; then
|
|
echo -e "\e[31m\nNo fingerprint sensor detected.\e[0m"
|
|
return 1
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
setup_pam_config() {
|
|
# Configure sudo
|
|
if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then
|
|
echo "Configuring sudo for fingerprint authentication..."
|
|
sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/sudo
|
|
fi
|
|
|
|
# Configure polkit. A clamshell gate runs before pam_fprintd: when the lid
|
|
# is shut the reader is unreachable, so it skips fingerprint (success=1) and
|
|
# PAM drops straight to the password prompt. Lid open → fingerprint, then
|
|
# password as the fallback.
|
|
#
|
|
# pam_exec needs a literal absolute path (no env expansion). Point at the
|
|
# fixed /usr/bin path the omarchy package always provides, so the gate keeps
|
|
# working across package installs and dev-link — the latter overlays
|
|
# $OMARCHY_PATH trees but leaves /usr/bin untouched.
|
|
local polkit_gate="auth [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed"
|
|
|
|
if [[ -f /etc/pam.d/polkit-1 ]]; then
|
|
if ! grep -q 'pam_fprintd.so' /etc/pam.d/polkit-1; then
|
|
echo "Configuring polkit for fingerprint authentication..."
|
|
sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/polkit-1
|
|
fi
|
|
if ! grep -q 'omarchy-hw-laptop-closed' /etc/pam.d/polkit-1; then
|
|
echo "Adding clamshell gate to polkit..."
|
|
# Insert immediately before pam_fprintd so success=1 skips exactly it.
|
|
sudo sed -i "/pam_fprintd\.so/i $polkit_gate" /etc/pam.d/polkit-1
|
|
fi
|
|
else
|
|
echo "Creating polkit configuration with fingerprint authentication..."
|
|
sudo tee /etc/pam.d/polkit-1 >/dev/null <<EOF
|
|
$polkit_gate
|
|
auth sufficient pam_fprintd.so
|
|
auth required pam_unix.so
|
|
|
|
account required pam_unix.so
|
|
password required pam_unix.so
|
|
session required pam_unix.so
|
|
EOF
|
|
fi
|
|
}
|
|
|
|
setup_lock_fingerprint_pam() {
|
|
echo "Configuring lock screen for fingerprint authentication..."
|
|
sudo tee /etc/pam.d/omarchy-lock-fingerprint >/dev/null <<'EOF'
|
|
#%PAM-1.0
|
|
auth required pam_fprintd.so
|
|
account include system-local-login
|
|
EOF
|
|
}
|
|
|
|
|
|
echo -e "\e[32mSetting up fingerprint scanner for authentication.\n\e[0m"
|
|
|
|
# Install required packages
|
|
echo "Installing required packages..."
|
|
|
|
installed_libfprint=$(pacman -Qq libfprint 2>/dev/null || true)
|
|
|
|
# libfprint-git provides+conflicts libfprint; pacman -S --noconfirm
|
|
# defaults the conflict prompt to N and aborts. Pre-remove the exact
|
|
# libfprint package, but not an installed provider like libfprint-git.
|
|
if [[ $installed_libfprint == "libfprint" ]]; then
|
|
sudo pacman -Rdd --noconfirm libfprint
|
|
fi
|
|
|
|
omarchy-pkg-add libfprint-git fprintd usbutils
|
|
|
|
if ! check_fingerprint_hardware; then
|
|
exit 1
|
|
fi
|
|
|
|
# Configure PAM
|
|
setup_pam_config
|
|
|
|
# Enroll first fingerprint
|
|
echo -e "\e[32m\nLet's setup your right index finger as the first fingerprint.\e[0m"
|
|
echo -e "Keep moving the finger around on sensor until the process completes.\n"
|
|
|
|
if sudo fprintd-enroll "$USER"; then
|
|
echo -e "\e[32m\nFingerprint enrolled successfully!\e[0m"
|
|
|
|
# Verify
|
|
echo -e "\nNow let's verify that it's working correctly.\n"
|
|
if fprintd-verify; then
|
|
setup_lock_fingerprint_pam
|
|
echo -e "\e[32m\nPerfect! Fingerprint authentication is now configured.\e[0m"
|
|
echo "You can use your fingerprint for sudo, polkit, and lock screen (Super + Ctrl + L)."
|
|
else
|
|
echo -e "\e[31m\nVerification failed. You may want to try enrolling again.\e[0m"
|
|
fi
|
|
else
|
|
echo -e "\e[31m\nEnrollment failed. Please try again.\e[0m"
|
|
exit 1
|
|
fi
|