1

5.18.9-arch1-1 Fingerprint sensor: 27c6:63ac Shenzhen Goodix Technology Co.,Ltd. Goodix USB2.0 MISC

I created a systemd service that runs a bash script when the system wakes from hibernate:

[Unit]
Description=User resume actions
After=hibernate.target

[Service]
User=marc
Type=forking
Environment=DISPLAY=:0
ExecStart=/usr/bin/lock.sh

[Install]
WantedBy=hibernate.target

Here is lock.sh:

#!/bin/bash
    
thisPid=$$
xsecurelock &
lock=$!

# loop until $lock is gone, or fingerprint is verified
until ! kill -0 $lock || fprintd-verify; do
    echo "FAILURE"
done

#kill the pid for the lock and thisPid
kill $lock
kill $thisPid

This script spawns xsecurelock and captures its pid. It then runs fprintd-verify and blocks until a fingerprint is successfully read. The script then kills xsecurelock and itself, which is redundant, I know.

The systemd service works fine. After waking, xsecurelock spawns, but I am unable to kill it with my fingerprint.

Note that lock.sh runs perfectly if I manually execute it. xsecurelock opens and I am able to kill it with my fingerprint. However, when I wake the screen (triggering the systemd file which triggers lock.sh), the screen locks with xsecurelock and I can type my password to unlock it, but fprintd-verify fails. The systemctl status is:

Jul 07 12:33:49 manray lock.sh[6630]: failed to claim device: GDBus.Error:net.reactivated.Fprint.Error.PermissionDenied: Not Authorized: ne>
Jul 07 12:33:49 manray lock.sh[4760]: FAILURE
Jul 07 12:33:49 manray lock.sh[6634]: Using device /net/reactivated/Fprint/Device/0
Jul 07 12:33:49 manray lock.sh[6634]: failed to claim device: GDBus.Error:net.reactivated.Fprint.Error.PermissionDenied: Not Authorized: ne>
Jul 07 12:33:49 manray lock.sh[4760]: FAILURE

How can I get fprintd-verify to claim the device.

EDIT: systemctl status when I set the user to root:

Jul 07 13:14:43 manray systemd[1]: Starting User resume actions...
Jul 07 13:14:43 manray lock.sh[25997]: Authorization required, but no authorization protocol specified
Jul 07 13:14:43 manray lock.sh[25997]: 2022-07-07T17:14:43Z 25997 xsecurelock: Could not connect to $DISPLAY.
Jul 07 13:14:44 manray lock.sh[25998]: Using device /net/reactivated/Fprint/Device/0
Jul 07 13:14:44 manray lock.sh[25998]: ListEnrolledFingers failed: GDBus.Error:net.reactivated.Fprint.Error.NoEnrolledPrints: Failed to dis>
Jul 07 13:14:44 manray lock.sh[25996]: FAILURE

When running as root, xsecurelock can't detect the display and the fingerprint sensor still does not work. It appears that there are no enrolled fingers for root and I am unable to add any.

1 Answer 1

0

The solution was to add a new rule at /usr/share/polkit-1/rules.d/50-net.reactivated.fprint.device.verify.rules:

polkit.addRule(function (action, subject) {
  if (action.id == "net.reactivated.fprint.device.verify") {
    return polkit.Result.YES
  }
})

This rule always allows fprintd-verify to run, reguardless of polkit authentication (I think).

I don't like this solution because it (seems) insecure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .