funman300
5305bb78c6
Adds /etc/pam.d/greetd to the TARGETS array so re-running enable-fingerprint.sh extends fprintd auth to the regreet login screen. Cold-boot timing and silent-touch UX caveats documented in the spec are accepted as-is — fingerprint failure falls back to password, no risk of lockout. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
60 lines
1.8 KiB
Bash
Executable File
60 lines
1.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# enable-fingerprint.sh — wire pam_fprintd.so into sudo + hyprlock auth stacks.
|
|
# Idempotent: re-runs are no-ops once the line is present. Run with sudo.
|
|
# Prerequisite: fprintd installed and at least one finger enrolled
|
|
# (run `fprintd-enroll` as your user first).
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo "Run as root: sudo bash $0" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v fprintd-enroll >/dev/null 2>&1; then
|
|
echo "ERROR: fprintd is not installed. Run install.sh first." >&2
|
|
exit 1
|
|
fi
|
|
|
|
PAM_LINE="auth sufficient pam_fprintd.so"
|
|
TARGETS=(/etc/pam.d/sudo /etc/pam.d/hyprlock /etc/pam.d/greetd)
|
|
|
|
for f in "${TARGETS[@]}"; do
|
|
if [ ! -f "$f" ]; then
|
|
echo "ERROR: $f does not exist. Is the corresponding package installed?" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if grep -q "pam_fprintd" "$f"; then
|
|
echo "$f: pam_fprintd already present — skipping"
|
|
continue
|
|
fi
|
|
|
|
backup="$f.bak.$(date +%s)"
|
|
cp -a "$f" "$backup"
|
|
echo "$f: backed up to $backup"
|
|
|
|
# Insert PAM_LINE on a new line directly before the first `auth ` directive.
|
|
awk -v line="$PAM_LINE" '
|
|
!inserted && /^auth[[:space:]]/ { print line; inserted = 1 }
|
|
{ print }
|
|
' "$f" > "$f.new"
|
|
|
|
if ! grep -q "pam_fprintd" "$f.new"; then
|
|
echo "ERROR: failed to insert PAM line into $f (no auth directive found?). Restoring backup." >&2
|
|
rm -f "$f.new"
|
|
exit 1
|
|
fi
|
|
|
|
mv "$f.new" "$f"
|
|
chmod --reference="$backup" "$f"
|
|
echo "$f: inserted '$PAM_LINE'"
|
|
done
|
|
|
|
echo
|
|
echo "Done. Test with: sudo true (should prompt for fingerprint)"
|
|
echo "Or lock the screen (Mod+Shift+E) and touch the reader."
|
|
echo
|
|
echo "To revert: restore the .bak.<ts> files in /etc/pam.d/, or:"
|
|
echo " sudo sed -i '/pam_fprintd/d' ${TARGETS[*]}"
|