feat: take the face in the lock screens of hyprland and niri
This commit is contained in:
Felitendo committed
1 parent
2a9b0d3f91
commit
c693ca216c
27 files changed
+1850
-1219
No files matched your search
+71
-12
@@ -1,17 +1,21 @@
|
||||
# shellcheck shell=bash
|
||||
#
|
||||
# Putting face unlock in front of sudo and polkit's admin prompts, and taking
|
||||
# it out again.
|
||||
# Putting face unlock in front of sudo, polkit's admin prompts and the lock
|
||||
# screens of Hyprland and Niri, and taking it out again.
|
||||
#
|
||||
# Two services and nothing else. The lock screen does not go through PAM at all
|
||||
# (see src/agent/lockcontroller.h), and the login screen stays with the
|
||||
# password: logging in is what unlocks the wallet, and a face has no password
|
||||
# to hand it.
|
||||
# The lock screens of Plasma and GNOME do not go through this at all: the
|
||||
# agent opens them (see src/agent/lockcontroller.h). hyprlock, swaylock and
|
||||
# the others are programs of their own that only open themselves, so the face
|
||||
# goes into their password check, and pressing Enter on the empty field is
|
||||
# how a scan starts. The login screen stays with the password: logging in is
|
||||
# what unlocks the wallet, and a face has no password to hand it.
|
||||
#
|
||||
# The line that goes in:
|
||||
#
|
||||
# -auth sufficient /usr/lib/security/pam_face_unlock.so
|
||||
#
|
||||
# with "lockscreen" after it for a lock screen (see the PAM module).
|
||||
#
|
||||
# "sufficient": a match lets the person in, anything else falls through to the
|
||||
# lines below as if this one were not there. The dash makes PAM skip it
|
||||
# quietly if the module ever goes missing, say because the package was removed
|
||||
@@ -29,6 +33,9 @@
|
||||
FU_PAM_MARK="# face-unlock: the face first, the password if that does not work"
|
||||
FU_PAM_WRAPPER_MARK="# Written by face-unlock."
|
||||
FU_PAM_SERVICES=(sudo polkit-1)
|
||||
# Lock screens with a PAM file of their own. One that uses "login" or
|
||||
# "system-auth" directly is left alone: those also let people log in.
|
||||
FU_PAM_LOCKERS=(hyprlock swaylock gtklock waylock)
|
||||
|
||||
# Overridable for the tests only; the root side never takes them from the
|
||||
# environment (see the top of face-unlock).
|
||||
@@ -52,8 +59,59 @@ fu_pam_vendor() {
|
||||
return 1
|
||||
}
|
||||
|
||||
# fu_pam_is_locker <service>
|
||||
fu_pam_is_locker() {
|
||||
local s
|
||||
for s in "${FU_PAM_LOCKERS[@]}"; do
|
||||
[[ $s == "$1" ]] && return 0
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
# fu_pam_line <service>
|
||||
fu_pam_line() {
|
||||
printf -- '-auth sufficient %s\n' "$FU_PAM_MODULE"
|
||||
if fu_pam_is_locker "$1"; then
|
||||
printf -- '-auth sufficient %s lockscreen\n' "$FU_PAM_MODULE"
|
||||
else
|
||||
printf -- '-auth sufficient %s\n' "$FU_PAM_MODULE"
|
||||
fi
|
||||
}
|
||||
|
||||
# fu_pam_lockers
|
||||
# The lock screens installed here, one per line.
|
||||
fu_pam_lockers() {
|
||||
local s
|
||||
for s in "${FU_PAM_LOCKERS[@]}"; do
|
||||
if [[ -f $(fu_pam_etc "$s") ]] || fu_pam_vendor "$s" > /dev/null; then
|
||||
printf '%s\n' "$s"
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
# fu_pam_lockers_list
|
||||
# The same, for people: "hyprlock, swaylock".
|
||||
fu_pam_lockers_list() {
|
||||
local list
|
||||
list="$(fu_pam_lockers | paste -sd ',')"
|
||||
printf '%s\n' "${list//,/, }"
|
||||
}
|
||||
|
||||
# fu_pam_lockers_here
|
||||
# Whether this desktop's lock screen is a program of its own (Hyprland,
|
||||
# Niri and the like), and one with a PAM file is installed.
|
||||
fu_pam_lockers_here() {
|
||||
[[ $FU_DESKTOP != plasma && $FU_DESKTOP != gnome && -n $(fu_pam_lockers) ]]
|
||||
}
|
||||
|
||||
# fu_pam_lockers_enabled
|
||||
# Whether every lock screen installed here takes the face, and there is one.
|
||||
fu_pam_lockers_enabled() {
|
||||
local s found=0
|
||||
while IFS= read -r s; do
|
||||
found=1
|
||||
fu_pam_enabled "$s" || return 1
|
||||
done < <(fu_pam_lockers)
|
||||
(( found ))
|
||||
}
|
||||
|
||||
# fu_pam_enabled <service>
|
||||
@@ -63,13 +121,13 @@ fu_pam_enabled() {
|
||||
[[ -r $file ]] && grep -q 'pam_face_unlock\.so' "$file"
|
||||
}
|
||||
|
||||
# fu_pam_insert <file>
|
||||
# fu_pam_insert <file> <service>
|
||||
# Prints the file with the line added before its first auth line. Debian and
|
||||
# Ubuntu have none in sudo's file, only "@include common-auth", and that
|
||||
# counts as one: after it the password has already been asked for. A file
|
||||
# with neither (which would be odd for either service) gets it at the end.
|
||||
fu_pam_insert() {
|
||||
awk -v mark="$FU_PAM_MARK" -v line="$(fu_pam_line)" '
|
||||
awk -v mark="$FU_PAM_MARK" -v line="$(fu_pam_line "$2")" '
|
||||
!done && ($0 ~ /^[[:space:]]*-?auth[[:space:]]/ || $0 ~ /^[[:space:]]*@include[[:space:]]+common-auth([[:space:]]|$)/) {
|
||||
print mark
|
||||
print line
|
||||
@@ -95,13 +153,14 @@ fu_pam_remove_lines() {
|
||||
' "$1"
|
||||
}
|
||||
|
||||
# fu_pam_wrapper <vendor file> <service>
|
||||
fu_pam_wrapper() {
|
||||
local vendor="$1"
|
||||
printf '#%%PAM-1.0\n'
|
||||
printf '%s The face first, then everything\n' "$FU_PAM_WRAPPER_MARK"
|
||||
printf '# %s does for this service. Removed again by\n' "$vendor"
|
||||
printf '# "face-unlock disable" or from its settings.\n\n'
|
||||
fu_pam_line
|
||||
fu_pam_line "$2"
|
||||
printf 'auth include %s\n' "$vendor"
|
||||
printf 'account include %s\n' "$vendor"
|
||||
printf 'password include %s\n' "$vendor"
|
||||
@@ -133,9 +192,9 @@ fu_pam_enable() {
|
||||
fu_pam_enabled "$service" && return 0
|
||||
|
||||
if [[ -f $file ]]; then
|
||||
content="$(fu_pam_insert "$file")" || return 1
|
||||
content="$(fu_pam_insert "$file" "$service")" || return 1
|
||||
elif vendor="$(fu_pam_vendor "$service")"; then
|
||||
content="$(fu_pam_wrapper "$vendor")"
|
||||
content="$(fu_pam_wrapper "$vendor" "$service")"
|
||||
else
|
||||
fu_bad "$(fu_msg "There is no PAM configuration for %s on this system." "$service")"
|
||||
return 1
|
||||
|
||||
Reference in new issue
Block a user