Bernardo Magri
7aae204014
Some checks failed
Check / eval (push) Failing after 2m45s
Bernardo promoted the PROPOSED item live: with fingerprint PAM on, sudo/login should accept whichever factor comes first instead of pam_fprintd's wait-for-the-reader-then-password. Stock PAM cannot express parallel factors (linux-pam#301), so this packages pam-fprint-grosshack v0.3.0 (pkgs/, pinned from GitLab — the field-standard fprintd fork), source-reviewed before packaging: every failure path (no reader, no prints, fprintd absent/hung, timeout, password typed) returns PAM_AUTHINFO_UNAVAIL and falls through; a typed password is only ferried via PAM_AUTHTOK to the stock `auth sufficient pam_unix.so … try_first_pass` rule — the module never validates passwords itself, so it cannot lock out password login. New option nomarchy.hardware.fingerprint.parallel, default TRUE (the better UX is what opting into fingerprint PAM buys; false = stock sequential). Wiring swaps the modulePath of stock fprintd's rule slot (mkForce) so the sufficient-before-pam_unix ordering is inherited, not recomputed. README + downstream template rows added. Verified: V2 — checks.hardware-toggles extended to three nodes, green: parallel node asserts the grosshack auth line precedes pam_unix in /etc/pam.d/sudo and that with NO reader a correct password still passes sudo while a wrong one fails (the lockout-safety invariant); seqpam node gets stock pam_fprintd and no grosshack; nopam gets neither. flake check + option-docs + template-sot green. V3 pending (HARDWARE-QUEUE, AMD dev box): the real type-or-touch race, fprintd-stopped fallback, hyprlock/greeter after a fingerprint win. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
51 lines
2.2 KiB
Nix
51 lines
2.2 KiB
Nix
# pam_fprintd_grosshack.so — fprintd's PAM module forked to accept the
|
|
# password OR a fingerprint at the same prompt (upstream calls itself a
|
|
# "gross hack"; it is also the field-standard answer to this PAM gap —
|
|
# stock PAM cannot express parallel factors, linux-pam#301).
|
|
#
|
|
# Source reviewed before packaging (2026-07-12, v0.3.0 = fprintd 1.94.2
|
|
# base + ~60-line delta): every failure path — no reader, no enrolled
|
|
# prints, fprintd absent, timeout, password typed — returns
|
|
# PAM_AUTHINFO_UNAVAIL, i.e. the module FAILS and PAM falls through to
|
|
# the password rule; a typed password is never validated here, only
|
|
# ferried via PAM_AUTHTOK to pam_unix (try_first_pass). Accepted
|
|
# quirks: installs a process-wide SIGUSR1 handler in the calling
|
|
# process, pthread_cancels the prompt thread on fingerprint win, and
|
|
# does not zeroize the prompt buffer. Consumed by
|
|
# modules/nixos/hardware.nix (nomarchy.hardware.fingerprint.parallel).
|
|
{ lib, stdenv, fetchFromGitLab, meson, ninja, pkg-config, gettext, python3
|
|
, glib, libfprint, polkit, pam, systemd, dbus, libpam-wrapper }:
|
|
|
|
stdenv.mkDerivation rec {
|
|
pname = "pam-fprint-grosshack";
|
|
version = "0.3.0";
|
|
|
|
src = fetchFromGitLab {
|
|
owner = "mishakmak";
|
|
repo = "pam-fprint-grosshack";
|
|
rev = "v${version}";
|
|
hash = "sha256-obczZbf/oH4xGaVvp3y3ZyDdYhZnxlCWvL0irgEYIi0=";
|
|
};
|
|
|
|
# Only the PAM module is built (the fork disables every other fprintd
|
|
# subdir), but the top-level meson still resolves the full fprintd
|
|
# dependency set — hence libfprint/polkit in buildInputs.
|
|
# pam_wrapper is only exercised by the (disabled) test suite, but the
|
|
# top-level meson marks it required whenever the pam option is on.
|
|
nativeBuildInputs = [ meson ninja pkg-config gettext python3 ];
|
|
buildInputs = [ glib libfprint polkit pam systemd dbus libpam-wrapper ];
|
|
|
|
mesonFlags = [
|
|
"-Dpam_modules_dir=${placeholder "out"}/lib/security"
|
|
"-Dsystemd=false"
|
|
"-Dman=false"
|
|
];
|
|
|
|
meta = {
|
|
description = "PAM module accepting password or fingerprint in parallel (fprintd fork)";
|
|
homepage = "https://gitlab.com/mishakmak/pam-fprint-grosshack";
|
|
license = lib.licenses.gpl2Plus;
|
|
platforms = lib.platforms.linux;
|
|
};
|
|
}
|