profiles: fprint: Fix fingerprint sudo integration#245
Conversation
Signed-off-by: Peter Jung <admin@ptr1337.dev>
There was a problem hiding this comment.
Pull request overview
Fixes fingerprint authentication for sudo by switching from an unsupported PAM drop-in approach to editing /etc/pam.d/sudo directly.
Changes:
- Replace creation of
/etc/pam.d/sudo.d/50-fprintd.confwith asedinsertion into/etc/pam.d/sudo. - Update removal logic to delete the inserted
# chwd-fprintdline from/etc/pam.d/sudo. - Keep enabling/disabling of
fprintd.serviceas part of install/remove hooks.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| post_remove = """ | ||
| if grep -q 'Managed by chwd' /etc/pam.d/sudo.d/50-fprintd.conf 2>/dev/null; then | ||
| rm -f /etc/pam.d/sudo.d/50-fprintd.conf | ||
| if [ -f /etc/pam.d/sudo ]; then | ||
| sed -i '/# chwd-fprintd/d' /etc/pam.d/sudo | ||
| fi |
There was a problem hiding this comment.
This update stops managing /etc/pam.d/sudo.d/50-fprintd.conf, but systems that previously installed this profile may still have the legacy drop-in file and directory left behind. Consider cleaning up the old managed file (e.g., if it contains the historical chwd marker) during install/upgrade or in post_remove so the profile doesn’t leave stale, confusing configuration artifacts.
| # Managed by chwd - DO NOT EDIT | ||
| auth sufficient pam_fprintd.so | ||
| EOF | ||
| if [ -f /etc/pam.d/sudo ] && ! grep -q 'chwd-fprintd' /etc/pam.d/sudo; then |
There was a problem hiding this comment.
The guard only checks for the marker string (chwd-fprintd). If a user/system already has an auth ... pam_fprintd.so line (without this marker), this will insert a second pam_fprintd entry, which can lead to multiple fingerprint prompts and a confusing PAM stack. Consider also checking for an existing pam_fprintd.so auth line (or otherwise detecting an existing fprint configuration) before inserting.
| if [ -f /etc/pam.d/sudo ] && ! grep -q 'chwd-fprintd' /etc/pam.d/sudo; then | |
| if [ -f /etc/pam.d/sudo ] \ | |
| && ! grep -q 'chwd-fprintd' /etc/pam.d/sudo \ | |
| && ! grep -Eq '^[[:space:]]*auth([[:space:]]+[^#[:space:]]+)*[[:space:]]+pam_fprintd\.so([[:space:]]|$)' /etc/pam.d/sudo; then |
vnepogodin
left a comment
vnepogodin
left a comment
There was a problem hiding this comment.
fair. hope auth won't get broken someday
sudo does not accept dropin files and therefore the fingerprint sudo auth did not work. Sed the normal pam.