GNU bug report logs - #56797
[PATCH] gnu: services: fprintd: Add PAM configuration.

Previous Next

Full log

View this message in rfc822 format

From: Maxime Devos <maximedevos <at> telenet.be>
To: Maya <maya.omase <at> protonmail.com>, 56797 <at> debbugs.gnu.org
Subject: [bug#56797] [PATCH] gnu: services: fprintd: Add PAM configuration.
Date: Wed, 27 Jul 2022 18:12:17 +0200

[Message part 1 (text/plain, inline)]

On 27-07-2022 17:57, Maya via Guix-patches via wrote:
> Added a feature to fprintd-service-type to allow unlocking PAM modules (ie. gdm login, gnome polkit etc.) by fingerprint.
>
> ---

Documentation is missing (in the manual), so as-is, this new feature is 
hard to find.

Also, the manual required giving every top-level procedure a docstring 
IIRC,

>   gnu/services/authentication.scm | 49 +++++++++++++++++++++++++++++++--
>   1 file changed, 46 insertions(+), 3 deletions(-)
>
> diff --git a/gnu/services/authentication.scm b/gnu/services/authentication.scm
> index f7becdfafb..5737c15f4c 100644
> --- a/gnu/services/authentication.scm
> +++ b/gnu/services/authentication.scm
> @@ -44,9 +44,50 @@ (define-module (gnu services authentication)
>               nslcd-configuration?
>               nslcd-service-type))
>
> -(define-configuration fprintd-configuration
> +(define-configuration/no-serialization fprintd-configuration
>     (fprintd      (file-like fprintd)
> -                "The fprintd package"))
> +                "The fprintd package")
> +  (unlock-gdm?
> +   (boolean #t)
> +   "Generate PAM configuration that unlocks gdm with fprintd.")
> +  (unlock-other
> +   (list '("polkit-1" "sddm")) ;; polkit-1 is the name of a PAM module for GNOME polkit
> +   "List of other PAM modules that can be unlocked with fprintd.
> +
> +This depends on your desktop configuration. If you for example want GNOME prompts to be unlocked by fingerprint, you add @code{polkit-1} to this list. (This is enabled by default.)
> +"))

This documentation is unclear -- does this field need to be set to the 
_name_ of the module, or to the _file name_ of the _shared library_ (as 
a file-like, not a direct file name, because of staging), or ...?  Also, 
the 'list' check can be more precise, IIRC there was some method for not 
just using list? but doing things like list-of-strings?.

Anyway, I don't really know PAM, but I've written some comments on the 
patch, hopefullt they are useful.

[OpenPGP_0x49E3EE22191725EE.asc (application/pgp-keys, attachment)]

[OpenPGP_signature (application/pgp-signature, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.