Fimeg/souveraine
Watch
1
0
Fork
You've already forked souveraine
 0
Code Releases Activity

packaging: the FPC pam module is pam_souveraine_fpc.so

Browse source 
blueline-fingerprintd installs /usr/lib/security/pam_souveraine_fpc.so
(PKGBUILD:48). cc541d1 named pam_fpc_polkit.so, which exists nowhere.

The leading '-' means a missing module is skipped without complaint, so
a wrong name here fails silently and permanently: the finger does
nothing and no log says why.

The module returns PAM_IGNORE outside PAM_SERVICE=polkit-1
(fpc-polkit-pam.c:86), so step-up falls through to the password stack
until that allowlist widens.
This commit is contained in:
Fimeg 2026-08-12 10:50:12 -04:00
commit 5cc7a90f44
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
packaging/souveraine-stepup.pam
View file

@ -5,9 +5,10 @@
# step-up must accept exactly the credentials the lockscreen accepts, no more.
#
# The leading '-' loads the FPC factor only where it is installed, so one file
# serves the phone and the laptop. The module is polkit-1-only today and
# returns PAM_IGNORE here until its service allowlist is widened.
-auth sufficient pam_fpc_polkit.so
# serves the phone and the laptop. blueline-fingerprintd ships the module; it
# accepts only PAM_SERVICE=polkit-1 today and returns PAM_IGNORE here, falling
# through to the password stack until its service check is widened.
-auth sufficient pam_souveraine_fpc.so
auth include login
account include login