Skip to content

profiles: fprint: Fix fingerprint sudo integration #245

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vnepogodin merged 1 commit into from
Apr 23, 2026
Merged

profiles: fprint: Fix fingerprint sudo integration #245

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 5 additions & 7 deletions profiles/usb/fprint/profiles.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,15 +24,13 @@ priority = 5
packages = "fprintd"
post_install = """
systemctl enable fprintd.service
mkdir -p /etc/pam.d/sudo.d
cat > /etc/pam.d/sudo.d/50-fprintd.conf <<'EOF'
# Managed by chwd - DO NOT EDIT
auth sufficient pam_fprintd.so
EOF
if [ -f /etc/pam.d/sudo ] && ! grep -q 'chwd-fprintd' /etc/pam.d/sudo; then
Copy link

Copilot AI Apr 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The guard only checks for the marker string (chwd-fprintd). If a user/system already has an auth ... pam_fprintd.so line (without this marker), this will insert a second pam_fprintd entry, which can lead to multiple fingerprint prompts and a confusing PAM stack. Consider also checking for an existing pam_fprintd.so auth line (or otherwise detecting an existing fprint configuration) before inserting.

Suggested change
if [ -f /etc/pam.d/sudo ] && ! grep -q 'chwd-fprintd' /etc/pam.d/sudo; then
if [ -f /etc/pam.d/sudo ] \
&& ! grep -q 'chwd-fprintd' /etc/pam.d/sudo \
&& ! grep -Eq '^[[:space:]]*auth([[:space:]]+[^#[:space:]]+)*[[:space:]]+pam_fprintd\.so([[:space:]]|$)' /etc/pam.d/sudo; then

Copilot uses AI. Check for mistakes.
sed -i '0,/^auth/{s//auth sufficient pam_fprintd.so # chwd-fprintd\n&/}' /etc/pam.d/sudo
fi
"""
post_remove = """
if grep -q 'Managed by chwd' /etc/pam.d/sudo.d/50-fprintd.conf 2>/dev/null; then
rm -f /etc/pam.d/sudo.d/50-fprintd.conf
if [ -f /etc/pam.d/sudo ]; then
sed -i '/# chwd-fprintd/d' /etc/pam.d/sudo
fi
Comment on lines 31 to 34
Copy link

Copilot AI Apr 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This update stops managing /etc/pam.d/sudo.d/50-fprintd.conf, but systems that previously installed this profile may still have the legacy drop-in file and directory left behind. Consider cleaning up the old managed file (e.g., if it contains the historical chwd marker) during install/upgrade or in post_remove so the profile doesn’t leave stale, confusing configuration artifacts.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Member Author

@ptr1337 ptr1337 Apr 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nah

if ! systemctl list-dependencies --reverse fprintd.service 2>/dev/null | grep -q .; then
systemctl disable fprintd.service
Expand Down
Loading