Fimeg/SouveraineOS
Watch
1
0
Fork
You've already forked SouveraineOS
 0
Code Releases Activity

docs: define temporary FPC Polkit bridge

Browse source
This commit is contained in:
Fimeg 2026-08-10 20:46:28 -04:00
commit a1c184d355
1 changed files with 43 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

62
docs/tasks/44-fingerprint-fpc1020.md
View file

@ -292,31 +292,49 @@ So the deliverable is **`souveraine-fpd`**: a system daemon owning
`gazed` does, and minting through `souveraine-stepup`. The `fp-*.py` tools are
instruments, not the factor.
### Preview surface — built 2026-08-10, deliberately not a factor
### Temporary post-login Polkit factor — built 2026-08-10
The smaller `blueline-fingerprintd` producer now publishes its own FPC IRQ as
a root-owned, world-readable pulse record at
`/run/blueline-fingerprintd/preview-pulse`. The Souveraine touch lock watches
that record and shows a configurable three-second hold exercise; the settings
page labels it a wiring preview and it is off by default. The daemon is now
`blueline-fingerprintd` package-owned as well as present in the provisioning
overlay, so a normal `pacman -Syu` can update the live device path.
The smaller `blueline-fingerprintd` producer now has two bounded outputs from
the same real FPC assertion:
This proves only **FPC daemon → shell preview**. The pulse neither calls
`unlocked()` nor mints a step-up grant, and the hold always says PIN remains
required. The reader's `KEY_WAKEUP` stays mapped to panel wake only: the FTS
touch driver emits the same generic key, so binding that key inside Hyprland
would falsely call a touchscreen double-tap an FPC event. A real factor still
needs `souveraine-fpd`'s verified match result and TASK-41's attested producer
route.
- `/run/blueline-fingerprintd/preview-pulse` is root-owned and world-readable.
The Souveraine lock surface may use it only for the optional wiring exercise.
- `/run/blueline-fingerprintd/polkit-approval` is root-only, expires after
eight seconds, and is atomically consumed exactly once by
`pam_souveraine_fpc.so`. It exists only long enough to satisfy a blank
`polkit-1` PAM conversation after the fullscreen Polkit surface has shown
its three-second confirmation interval.
**The intended real flow is PIN after boot, FPC after that.** The PIN performs
the first unlock that makes Personal-class key material and the enrolled FPC
template database available. A verified FPC match may then unlock a later
screen lock or mint a narrow read/step-up grant, according to the requested
operation; it never replaces first-boot storage unlock, household membership,
or remote-device admission. A reboot returns the device to PIN-required. The
raw IRQ and this preview do none of those things.
This is an intentional bridge while match-on-chip verification lands. It is a
real PAM result, not a shell-side boolean: the fullscreen Polkit surface
continues to own the prompt, PAM decides success, and the ordinary PIN/password
conversation remains its fallback. It covers user-facing **Polkit only**. It
cannot satisfy first login, first storage unlock after boot, screen-lock PAM,
sudo, SSH, remote admission, or household/device enrollment. A reboot erases
the record and returns the device to PIN-required.
The bridge does **not** claim continuous finger presence or a verified
fingerprint. The current hardware proof is one re-arm-safe FPC IRQ, not a
template match; the visible three seconds make the temporary interaction
deliberate rather than pretending to add biometric evidence. The package
inserts a narrowly marked `pam_souveraine_fpc.so` line ahead of the existing
`polkit-1` auth stack and saves the preimage. If a Polkit upgrade produces a
`.pacnew`, merge the marked three-line block deliberately; do not let a package
upgrade silently erase the factor.
The reader's `KEY_WAKEUP` stays mapped to panel wake only: the FTS touch driver
emits the same generic key, so binding that key inside Hyprland would falsely
call a touchscreen double-tap an FPC event. The FPC daemon record, not the
generic key, is the only source the Polkit UI observes.
**The intended enduring flow remains PIN after boot, verified FPC after that.**
The PIN performs the first unlock that makes Personal-class key material and
the enrolled FPC template database available. `souveraine-fpd` will replace
this raw-IRQ bridge with a verified match result without changing the Polkit
surface or its PAM ownership. A verified match may then unlock a later screen
lock or mint a narrow read/step-up grant, according to the requested operation;
it never replaces first-boot storage unlock, household membership, or
remote-device admission.
### Prior art, checked 2026-08-09