[solved] systemd screen lock with fingerprint on wake

manray · 2022-07-08 03:58:39

5.18.9-arch1-1 Fingerprint sensor: 27c6:63ac Shenzhen Goodix Technology Co.,Ltd. Goodix USB2.0 MISC

I created a systemd service that runs a bash script when the system wakes from hibernate:

[Unit]
Description=User resume actions
After=hibernate.target

[Service]
User=marc
Type=forking
Environment=DISPLAY=:0
ExecStart=/usr/bin/lock.sh

[Install]
WantedBy=hibernate.target

Here is lock.sh:

#!/bin/bash
    
thisPid=$$
xsecurelock &
lock=$!

# loop until $lock is gone, or fingerprint is verified
until ! kill -0 $lock || fprintd-verify; do
    echo "FAILURE"
done

#kill the pid for the lock and thisPid
kill $lock
kill $thisPid

This script spawns xsecurelock and captures its pid. It then runs fprintd-verify and blocks until a fingerprint is successfully read. The script then kills xsecurelock and itself, which is redundant, I know.

The systemd service works fine. After waking, xsecurelock spawns, but I am unable to kill it with my fingerprint.

Note that lock.sh runs perfectly if I manually execute it. xsecurelock opens and I am able to kill it with my fingerprint. However, when I wake the screen (triggering the systemd file which triggers lock.sh), the screen locks with xsecurelock and I can type my password to unlock it, but fprintd-verify fails. The systemctl status is:

Jul 08 22:38:21 manray lock.sh[274108]: failed to claim device: GDBus.Error:net.reactivated.Fprint.Error.PermissionDenied: Not Authorized: net.reactivated.fprint.device.enroll
Jul 08 22:38:21 manray lock.sh[272217]: FAILURE
Jul 08 22:38:21 manray lock.sh[274112]: Using device /net/reactivated/Fprint/Device/0
Jul 08 22:38:21 manray lock.sh[274112]: failed to claim device: GDBus.Error:net.reactivated.Fprint.Error.PermissionDenied: Not Authorized: net.reactivated.fprint.device.enroll
Jul 08 22:38:21 manray lock.sh[272217]: FAILURE

How can I get fprintd-verify to claim the device.

systemctl status when I set the user to root:

Jul 07 13:14:43 manray systemd[1]: Starting User resume actions...
Jul 07 13:14:43 manray lock.sh[25997]: Authorization required, but no authorization protocol specified
Jul 07 13:14:43 manray lock.sh[25997]: 2022-07-07T17:14:43Z 25997 xsecurelock: Could not connect to $DISPLAY.
Jul 07 13:14:44 manray lock.sh[25998]: Using device /net/reactivated/Fprint/Device/0
Jul 07 13:14:44 manray lock.sh[25998]: ListEnrolledFingers failed: GDBus.Error:net.reactivated.Fprint.Error.NoEnrolledPrints: Failed to dis>
Jul 07 13:14:44 manray lock.sh[25996]: FAILURE

When running as root, xsecurelock can't detect the display and the fingerprint sensor still does not work. It appears that there are no enrolled fingers for root and I am unable to add any.

Last edited by manray (2022-07-09 11:48:58)

seth · 2022-07-08 08:28:49

Not Authorized: ne>

Don't copy and paste from the pager, it truncates the error message.

Try to add DBUS_SESSION_BUS_ADDRESS to the environment or use a --user service.

manray · 2022-07-09 02:58:58

seth wrote:

Not Authorized: ne>
Don't copy and paste from the pager, it truncates the error message.
Try to add DBUS_SESSION_BUS_ADDRESS to the environment or use a --user service.

I have reposted with the untruncated message.

Adding "Environment=DBUS_SESSION_BUS_ADDRESS=unix:path=%t/bus" changes nothing.

I can't run it as a --user service because it needs to be able to interact with suspend.target. I don't believe user services can do this.

seth · 2022-07-09 07:40:09

/usr/share/polkit-1/actions/net.reactivated.fprint.device.policy has net.reactivated.fprint.device.enroll at

<defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_self_keep</allow_active>
    </defaults>

what means you have to be the active user and still authenticate yourself via the polkit agent.

https://github.com/i3/i3lock/issues/210
https://wiki.archlinux.org/title/fprint … _enrolling

You could try to make it unconditionally "return polkit.Result.AUTH_SELF_KEEP" and whether that allows you to invoke polkit, then maybe narrow it down to your user.

manray · 2022-07-09 11:00:37

seth wrote:

/usr/share/polkit-1/actions/net.reactivated.fprint.device.policy has net.reactivated.fprint.device.enroll at
<defaults>
      <allow_any>no</allow_any>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_self_keep</allow_active>
    </defaults>
what means you have to be the active user and still authenticate yourself via the polkit agent.
https://github.com/i3/i3lock/issues/210
https://wiki.archlinux.org/title/fprint … _enrolling
You could try to make it unconditionally "return polkit.Result.AUTH_SELF_KEEP" and whether that allows you to invoke polkit, then maybe narrow it down to your user.

Thanks for finding that information. It was very helpful! The solution was to add a new rule at `/usr/share/polkit-1/rules.d/50-net.reactivated.fprint.device.verify.rules`:

polkit.addRule(function (action, subject) {
  if (action.id == "net.reactivated.fprint.device.verify") {
    return polkit.Result.YES
  }
})

I don't like this solution because it (seems) insecure.

If nobody posts a better solution or offers any further explanation, I will mark this as solved. Thanks again seth!

seth · 2022-07-09 15:33:52

I don't like this solution because it (seems) insecure.

That's why I suggested to go w/ more protective measures first.
Since the problem is ("maybe") that your session isn't active before you unlocked it,

polkit.addRule(function (action, subject) {
  if (action.id == "net.reactivated.fprint.device.verify" && subject.local && subject.inactive) {
    return polkit.Result.AUTH_SELF_KEEP;
  }
})

might suffice. You can also restrict this to your user ("subject.user === "marc""), members of special groups etcetc.

Arch Linux

#1 2022-07-08 03:58:39

[solved] systemd screen lock with fingerprint on wake

#2 2022-07-08 08:28:49

Re: [solved] systemd screen lock with fingerprint on wake

#3 2022-07-09 02:58:58

Re: [solved] systemd screen lock with fingerprint on wake

#4 2022-07-09 07:40:09

Re: [solved] systemd screen lock with fingerprint on wake

#5 2022-07-09 11:00:37

Re: [solved] systemd screen lock with fingerprint on wake

#6 2022-07-09 15:33:52

Re: [solved] systemd screen lock with fingerprint on wake

Board footer