From 66b028163cfd7caa66ea8fb70c4433db6719792c Mon Sep 17 00:00:00 2001 From: Ola Cewers Date: Sat, 30 May 2026 16:48:24 +0200 Subject: [PATCH 1/2] Gate sudo fingerprint behind lid state (clamshell) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When fingerprint auth is set up, pam_fprintd is inserted first and `sufficient` in /etc/pam.d/sudo, so it blocks the password prompt with "Place your finger…". In clamshell mode (lid closed, docked to an external monitor) the reader is unreachable, forcing an awkward wait before every sudo. Gate pam_fprintd behind a small pam_exec helper that checks the laptop lid state, so fingerprint is only attempted when the lid is open and sudo falls straight through to the password stack when the lid is closed. - sudo only; polkit is left as-is (its GUI dialog shows a password field in parallel and never blocks the way terminal sudo does) - desktops / machines without an ACPI lid button are untouched - fail-safe: helper missing / errors / unknown lid state -> password, never lockout Co-Authored-By: Claude Opus 4.8 --- bin/omarchy-remove-security-fingerprint | 7 +++++ bin/omarchy-setup-security-fingerprint | 40 +++++++++++++++++++++++-- migrations/1780152390.sh | 26 ++++++++++++++++ 3 files changed, 71 insertions(+), 2 deletions(-) create mode 100644 migrations/1780152390.sh diff --git a/bin/omarchy-remove-security-fingerprint b/bin/omarchy-remove-security-fingerprint index 1bbc7982af..1cdce66580 100755 --- a/bin/omarchy-remove-security-fingerprint +++ b/bin/omarchy-remove-security-fingerprint @@ -18,6 +18,13 @@ remove_pam_config() { echo "Removing fingerprint authentication from polkit..." sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/polkit-1 fi + + # Remove the sudo lid guard + helper (added when fingerprint was set up on a laptop) + if grep -q omarchy-lid-open /etc/pam.d/sudo 2>/dev/null; then + echo "Removing lid guard from sudo..." + sudo sed -i '/omarchy-lid-open/d' /etc/pam.d/sudo + fi + sudo rm -f /usr/local/bin/omarchy-lid-open } remove_hyprlock_fingerprint_icon() { diff --git a/bin/omarchy-setup-security-fingerprint b/bin/omarchy-setup-security-fingerprint index f704348e23..857ff5bd3b 100755 --- a/bin/omarchy-setup-security-fingerprint +++ b/bin/omarchy-setup-security-fingerprint @@ -18,14 +18,50 @@ check_fingerprint_hardware() { return 0 } +# True only on machines with an ACPI lid button (i.e. laptops). Desktops fall +# through and keep the plain "fingerprint first" behavior, untouched. +has_lid() { + local f + for f in /proc/acpi/button/lid/*/state; do + [[ -e "$f" ]] && return 0 + done + return 1 +} + +# Install the lid-state helper that pam_exec consults before pam_fprintd. +# Lives in /usr/local/bin so PAM (root) has a stable path independent of $PATH. +install_lid_helper() { + echo "Installing lid-state helper for fingerprint gating..." + sudo tee /usr/local/bin/omarchy-lid-open >/dev/null <<'EOF' +#!/bin/bash +# omarchy:summary=Exit 0 if the laptop lid is open (used by PAM to gate fingerprint auth) +for f in /proc/acpi/button/lid/*/state; do + [[ -r "$f" ]] || continue + grep -q open "$f" && exit 0 || exit 1 +done +exit 0 +EOF + sudo chmod 755 /usr/local/bin/omarchy-lid-open +} + setup_pam_config() { - # Configure sudo + # Configure sudo. On laptops, gate pam_fprintd behind the lid state so a + # closed-lid / clamshell session falls straight through to the password + # prompt instead of blocking on an unreachable reader. if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then echo "Configuring sudo for fingerprint authentication..." sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/sudo fi - # Configure polkit + if has_lid && ! grep -q omarchy-lid-open /etc/pam.d/sudo; then + echo "Gating sudo fingerprint behind lid state..." + install_lid_helper + sudo sed -i '/pam_fprintd\.so/i auth [success=ignore default=1] pam_exec.so quiet /usr/local/bin/omarchy-lid-open' /etc/pam.d/sudo + fi + + # Configure polkit (unchanged). The polkit agent shows a password field in + # parallel with fingerprint, so it never blocks the way terminal sudo does + # and needs no lid guard. if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_fprintd.so' /etc/pam.d/polkit-1; then echo "Configuring polkit for fingerprint authentication..." sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/polkit-1 diff --git a/migrations/1780152390.sh b/migrations/1780152390.sh new file mode 100644 index 0000000000..0f237960a3 --- /dev/null +++ b/migrations/1780152390.sh @@ -0,0 +1,26 @@ +echo "Gate sudo fingerprint behind lid state (skip fingerprint when the laptop lid is closed)" + +# Desktops / machines without an ACPI lid button are left completely untouched. +lid_present=false +for f in /proc/acpi/button/lid/*/state; do + [[ -e "$f" ]] && lid_present=true +done +$lid_present || exit 0 + +# Only relevant if sudo actually uses fingerprint and isn't already guarded. +if grep -q pam_fprintd.so /etc/pam.d/sudo && ! grep -q omarchy-lid-open /etc/pam.d/sudo; then + # Install / refresh the lid-state helper used by pam_exec. + sudo tee /usr/local/bin/omarchy-lid-open >/dev/null <<'EOF' +#!/bin/bash +# omarchy:summary=Exit 0 if the laptop lid is open (used by PAM to gate fingerprint auth) +for f in /proc/acpi/button/lid/*/state; do + [[ -r "$f" ]] || continue + grep -q open "$f" && exit 0 || exit 1 +done +exit 0 +EOF + sudo chmod 755 /usr/local/bin/omarchy-lid-open + + # Insert the guard immediately above the existing pam_fprintd line. + sudo sed -i '/pam_fprintd\.so/i auth [success=ignore default=1] pam_exec.so quiet /usr/local/bin/omarchy-lid-open' /etc/pam.d/sudo +fi From cea67669ae87187dd47a861da7c63d1ee7cd6311 Mon Sep 17 00:00:00 2001 From: Ola Cewers Date: Sat, 30 May 2026 17:01:20 +0200 Subject: [PATCH 2/2] Use explicit if/else in lid helper instead of `&& exit 0 || exit 1` Address review feedback: the `cmd && exit 0 || exit 1` idiom is a known footgun and obscures intent. Spell it out as an if/else in both the setup helper and the migration's copy. Co-Authored-By: Claude Opus 4.8 --- bin/omarchy-setup-security-fingerprint | 2 +- migrations/1780152390.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/omarchy-setup-security-fingerprint b/bin/omarchy-setup-security-fingerprint index 857ff5bd3b..90fad730ed 100755 --- a/bin/omarchy-setup-security-fingerprint +++ b/bin/omarchy-setup-security-fingerprint @@ -37,7 +37,7 @@ install_lid_helper() { # omarchy:summary=Exit 0 if the laptop lid is open (used by PAM to gate fingerprint auth) for f in /proc/acpi/button/lid/*/state; do [[ -r "$f" ]] || continue - grep -q open "$f" && exit 0 || exit 1 + if grep -q open "$f"; then exit 0; else exit 1; fi done exit 0 EOF diff --git a/migrations/1780152390.sh b/migrations/1780152390.sh index 0f237960a3..35269af0a0 100644 --- a/migrations/1780152390.sh +++ b/migrations/1780152390.sh @@ -15,7 +15,7 @@ if grep -q pam_fprintd.so /etc/pam.d/sudo && ! grep -q omarchy-lid-open /etc/pam # omarchy:summary=Exit 0 if the laptop lid is open (used by PAM to gate fingerprint auth) for f in /proc/acpi/button/lid/*/state; do [[ -r "$f" ]] || continue - grep -q open "$f" && exit 0 || exit 1 + if grep -q open "$f"; then exit 0; else exit 1; fi done exit 0 EOF