Re: Trouble getting 'fprintd-service-type' to work

[Danny Milosavljevic <dannym@scratchpost.org>]

[-- Attachment #1: Type: text/plain, Size: 1306 bytes --]

Hi Mark,

On Sat, 20 Apr 2019 16:21:44 -0400
Mark H Weaver <mhw@netris.org> wrote:

> Thanks, but did you test that it actually works in practice?
> 
> I strongly suspect that it still won't work.  According to
> <https://wiki.archlinux.org/index.php/Fprint>, the 'pam_fprintd.so'
> module needs to be added to the PAM configuration.

That is only required if not using gdm.  I think since we force gdm now it
should work as-is.

> So, I guess we also need something along the lines of the following,
> which is used in 'elogind-service-type' in (gnu services desktop):
> 
>                        ;; Extend PAM with pam_fprintd.so.
>                        (service-extension pam-root-service-type
>                                           pam-extension-procedure)

Yes, but we'd have to amend the etc/pam.d/login file and that
would mean we'd have to add an entire authentication configuration
mechanism to guix (where to allow fingerprint authentication
and where not to allow it is a policy decision done by the
system administrator and should not be hard-coded).

I've found one comment "./sddm.scm: ;; should be factored out into
system-auth" that maybe suggests such a guix configuration already
exists somewhere, but I can't find it.

I'm not sure how to proceed.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]