Dateien nach "Main" hochladen
This commit is contained in:
59
Main/gnome-fingerprint-feedback-deploy.md
Normal file
59
Main/gnome-fingerprint-feedback-deploy.md
Normal file
@@ -0,0 +1,59 @@
|
|||||||
|
# GNOME/GDM Fingerprint Feedback Deployment
|
||||||
|
|
||||||
|
This provides a team-friendly deployment path for faster visible fingerprint failure feedback on Fedora systems using authselect.
|
||||||
|
|
||||||
|
## Files
|
||||||
|
- `tools/gnome_fprint_feedback_setup.sh`
|
||||||
|
- `tools/gnome_fprint_feedback_rollback.sh`
|
||||||
|
|
||||||
|
## Apply
|
||||||
|
|
||||||
|
Default (recommended):
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /home/jan/Documents/RFP/WLED-MM/repo
|
||||||
|
sudo ./tools/gnome_fprint_feedback_setup.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
Custom tuning:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo ./tools/gnome_fprint_feedback_setup.sh --max-tries 2 --timeout 6
|
||||||
|
```
|
||||||
|
|
||||||
|
## Validate
|
||||||
|
|
||||||
|
```bash
|
||||||
|
authselect current --raw
|
||||||
|
authselect check
|
||||||
|
grep pam_fprintd /etc/authselect/custom/local-fprint-feedback/fingerprint-auth
|
||||||
|
grep pam_fprintd /etc/pam.d/fingerprint-auth
|
||||||
|
```
|
||||||
|
|
||||||
|
Expected effective line:
|
||||||
|
|
||||||
|
```text
|
||||||
|
pam_fprintd.so max-tries=2 timeout=6
|
||||||
|
```
|
||||||
|
|
||||||
|
## Rollback
|
||||||
|
|
||||||
|
Restore previous authselect selection saved during setup:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /home/jan/Documents/RFP/WLED-MM/repo
|
||||||
|
sudo ./tools/gnome_fprint_feedback_rollback.sh
|
||||||
|
```
|
||||||
|
|
||||||
|
Rollback and remove custom profile directory:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
sudo ./tools/gnome_fprint_feedback_rollback.sh --remove-profile
|
||||||
|
```
|
||||||
|
|
||||||
|
## Notes
|
||||||
|
- Scripts must be run as root.
|
||||||
|
- Setup stores previous `authselect current --raw` in:
|
||||||
|
- `/etc/authselect/custom/local-fprint-feedback/.previous-authselect-raw`
|
||||||
|
- If no saved state exists, rollback falls back to:
|
||||||
|
- `local with-fingerprint with-silent-lastlog with-mdns4`
|
||||||
82
Main/gnome_fprint_feedback_rollback.sh
Normal file
82
Main/gnome_fprint_feedback_rollback.sh
Normal file
@@ -0,0 +1,82 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
PROFILE_NAME="local-fprint-feedback"
|
||||||
|
PROFILE_PATH="/etc/authselect/custom/${PROFILE_NAME}"
|
||||||
|
STATE_FILE="${PROFILE_PATH}/.previous-authselect-raw"
|
||||||
|
REMOVE_PROFILE=false
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
cat <<USAGE
|
||||||
|
Usage: sudo $0 [--profile NAME] [--remove-profile]
|
||||||
|
|
||||||
|
Restores the previous authselect selection captured by setup script.
|
||||||
|
If no saved state exists, falls back to local profile with common features.
|
||||||
|
|
||||||
|
Options:
|
||||||
|
--profile NAME Custom authselect profile name (default: local-fprint-feedback)
|
||||||
|
--remove-profile Remove the custom profile directory after rollback
|
||||||
|
-h, --help Show this help
|
||||||
|
USAGE
|
||||||
|
}
|
||||||
|
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
--profile)
|
||||||
|
PROFILE_NAME="$2"
|
||||||
|
PROFILE_PATH="/etc/authselect/custom/${PROFILE_NAME}"
|
||||||
|
STATE_FILE="${PROFILE_PATH}/.previous-authselect-raw"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
--remove-profile)
|
||||||
|
REMOVE_PROFILE=true
|
||||||
|
shift
|
||||||
|
;;
|
||||||
|
-h|--help)
|
||||||
|
usage
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Unknown argument: $1" >&2
|
||||||
|
usage >&2
|
||||||
|
exit 2
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ "${EUID}" -ne 0 ]]; then
|
||||||
|
echo "Please run as root (sudo)." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! command -v authselect >/dev/null 2>&1; then
|
||||||
|
echo "authselect not found." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ -f "$STATE_FILE" ]]; then
|
||||||
|
PREV_RAW="$(tr -d '\r' < "$STATE_FILE" | head -n1)"
|
||||||
|
PREV_PROFILE="${PREV_RAW%% *}"
|
||||||
|
PREV_FEATURES="${PREV_RAW#${PREV_PROFILE}}"
|
||||||
|
PREV_FEATURES="${PREV_FEATURES# }"
|
||||||
|
if [[ -n "$PREV_PROFILE" ]]; then
|
||||||
|
# shellcheck disable=SC2086
|
||||||
|
authselect select "$PREV_PROFILE" $PREV_FEATURES --force
|
||||||
|
else
|
||||||
|
authselect select local with-fingerprint with-silent-lastlog with-mdns4 --force
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
authselect select local with-fingerprint with-silent-lastlog with-mdns4 --force
|
||||||
|
fi
|
||||||
|
|
||||||
|
authselect apply-changes
|
||||||
|
authselect check
|
||||||
|
|
||||||
|
if [[ "$REMOVE_PROFILE" == true ]] && [[ -d "$PROFILE_PATH" ]]; then
|
||||||
|
rm -rf "$PROFILE_PATH"
|
||||||
|
echo "Removed profile directory: $PROFILE_PATH"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Rollback complete. Active profile: $(authselect current --raw)"
|
||||||
|
echo "Effective pam_fprintd line:"
|
||||||
|
grep -n 'pam_fprintd' /etc/pam.d/fingerprint-auth || true
|
||||||
109
Main/gnome_fprint_feedback_setup.sh
Normal file
109
Main/gnome_fprint_feedback_setup.sh
Normal file
@@ -0,0 +1,109 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
PROFILE_NAME="local-fprint-feedback"
|
||||||
|
PROFILE_PATH="/etc/authselect/custom/${PROFILE_NAME}"
|
||||||
|
STATE_FILE="${PROFILE_PATH}/.previous-authselect-raw"
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
cat <<USAGE
|
||||||
|
Usage: sudo $0 [--max-tries N] [--timeout SEC] [--profile NAME]
|
||||||
|
|
||||||
|
Applies an authselect custom profile that sets pam_fprintd parameters
|
||||||
|
for faster visible fingerprint failure feedback in GDM/GNOME unlock.
|
||||||
|
|
||||||
|
Options:
|
||||||
|
--max-tries N Fingerprint tries before failure (default: 2)
|
||||||
|
--timeout SEC Fingerprint timeout in seconds (default: 6)
|
||||||
|
--profile NAME Custom authselect profile name (default: local-fprint-feedback)
|
||||||
|
-h, --help Show this help
|
||||||
|
USAGE
|
||||||
|
}
|
||||||
|
|
||||||
|
MAX_TRIES=2
|
||||||
|
TIMEOUT=6
|
||||||
|
|
||||||
|
while [[ $# -gt 0 ]]; do
|
||||||
|
case "$1" in
|
||||||
|
--max-tries)
|
||||||
|
MAX_TRIES="$2"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
--timeout)
|
||||||
|
TIMEOUT="$2"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
--profile)
|
||||||
|
PROFILE_NAME="$2"
|
||||||
|
PROFILE_PATH="/etc/authselect/custom/${PROFILE_NAME}"
|
||||||
|
STATE_FILE="${PROFILE_PATH}/.previous-authselect-raw"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
-h|--help)
|
||||||
|
usage
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Unknown argument: $1" >&2
|
||||||
|
usage >&2
|
||||||
|
exit 2
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ "${EUID}" -ne 0 ]]; then
|
||||||
|
echo "Please run as root (sudo)." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! command -v authselect >/dev/null 2>&1; then
|
||||||
|
echo "authselect not found." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! [[ "$MAX_TRIES" =~ ^-?[0-9]+$ ]] || ! [[ "$TIMEOUT" =~ ^-?[0-9]+$ ]]; then
|
||||||
|
echo "--max-tries and --timeout must be integers." >&2
|
||||||
|
exit 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
CURRENT_RAW="$(authselect current --raw)"
|
||||||
|
CURRENT_PROFILE="${CURRENT_RAW%% *}"
|
||||||
|
CURRENT_FEATURES="${CURRENT_RAW#${CURRENT_PROFILE}}"
|
||||||
|
CURRENT_FEATURES="${CURRENT_FEATURES# }"
|
||||||
|
|
||||||
|
if [[ ! -d "$PROFILE_PATH" ]]; then
|
||||||
|
authselect create-profile "$PROFILE_NAME" -b local
|
||||||
|
fi
|
||||||
|
|
||||||
|
FP_FILE="${PROFILE_PATH}/fingerprint-auth"
|
||||||
|
if [[ ! -f "$FP_FILE" ]]; then
|
||||||
|
echo "Expected file not found: $FP_FILE" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -f "$STATE_FILE" ]]; then
|
||||||
|
printf '%s\n' "$CURRENT_RAW" > "$STATE_FILE"
|
||||||
|
fi
|
||||||
|
|
||||||
|
cp -a "$FP_FILE" "${FP_FILE}.bak.$(date +%Y%m%d%H%M%S)"
|
||||||
|
perl -0pi -e "s/pam_fprintd\\.so\\b[^\\n]*/pam_fprintd.so max-tries=${MAX_TRIES} timeout=${TIMEOUT}/" "$FP_FILE"
|
||||||
|
|
||||||
|
if [[ "$CURRENT_PROFILE" == "custom/${PROFILE_NAME}" ]]; then
|
||||||
|
SELECT_FEATURES="$CURRENT_FEATURES"
|
||||||
|
else
|
||||||
|
SELECT_FEATURES="$CURRENT_FEATURES"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! grep -q 'with-fingerprint' <<<"$SELECT_FEATURES"; then
|
||||||
|
SELECT_FEATURES="${SELECT_FEATURES:+$SELECT_FEATURES }with-fingerprint"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# shellcheck disable=SC2086
|
||||||
|
authselect select "custom/${PROFILE_NAME}" $SELECT_FEATURES --force
|
||||||
|
authselect apply-changes
|
||||||
|
authselect check
|
||||||
|
|
||||||
|
echo "Applied custom authselect profile: custom/${PROFILE_NAME}"
|
||||||
|
echo "Active profile: $(authselect current --raw)"
|
||||||
|
echo "Effective pam_fprintd line:"
|
||||||
|
grep -n 'pam_fprintd' /etc/pam.d/fingerprint-auth
|
||||||
Reference in New Issue
Block a user