Trouble getting 'fprintd-service-type' to work

Trouble getting 'fprintd-service-type' to work

[Mark H Weaver]

Hi Danny,

I see that you're the author of 'fprintd-service-type', added last May
in the following commit:

  commit 7f93bbd5aadf0427190769fba8f478c29e37b4f4
  Author: Danny Milosavljevic <dannym@scratchpost.org>
  Date:   Wed May 30 19:43:48 2018 +0200
  
      services: Add fingerprint identification service.
      
      * gnu/services/authentication.scm: New file.
      * gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
      * doc/guix.texi (Miscellaneous Services): Document it.

Your manual entry for it seems to suggest that:

  (service fprintd-service-type)

is the correct incantation, and yet when I try to build a system with
this service, I see:

  guix system: error: /home/mhw/test-os-config.scm:77:19: no value specified for service of type 'fprintd'

Tobias reported seeing the same error, as well as a user on
help-guix@gnu.org who we're trying to help.

I tried adding:

  (default-value (fprintd-configuration))

to the 'fprintd-service-type' definition, but then I get this:

  guix system: error: #<<fprintd-configuration> ntp: #<package fprintd@0.7.0 gnu/packages/freedesktop.scm:1190 396be70>>: invalid G-expression input

and it looks like the 'ntp' field of 'fprintd-configuration' is probably
misnamed.

Did you test this service before pushing it to master?
Does it work for you?

      Thanks,
        Mark

Re: Trouble getting 'fprintd-service-type' to work

[Danny Milosavljevic]

[-- Attachment #1: Type: text/plain, Size: 313 bytes --]

Hi Mark,

On Tue, 16 Apr 2019 16:07:19 -0400
Mark H Weaver <mhw@netris.org> wrote:

> Did you test this service before pushing it to master?

I can't remember - but probably not.  Sorry.

> Does it work for you?

It didn't work but I fixed it now with commit 0682f084635cdc289aabafc4b2583639e00a28b3.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Trouble getting 'fprintd-service-type' to work

[Mark H Weaver]

Hi Danny,

Danny Milosavljevic <dannym@scratchpost.org> writes:

> On Tue, 16 Apr 2019 16:07:19 -0400
> Mark H Weaver <mhw@netris.org> wrote:
>
>> Did you test this service before pushing it to master?
>
> I can't remember - but probably not.  Sorry.
>
>> Does it work for you?
>
> It didn't work but I fixed it now with commit 0682f084635cdc289aabafc4b2583639e00a28b3.

Thanks, but did you test that it actually works in practice?

I strongly suspect that it still won't work.  According to
<https://wiki.archlinux.org/index.php/Fprint>, the 'pam_fprintd.so'
module needs to be added to the PAM configuration.

So, I guess we also need something along the lines of the following,
which is used in 'elogind-service-type' in (gnu services desktop):

                       ;; Extend PAM with pam_fprintd.so.
                       (service-extension pam-root-service-type
                                          pam-extension-procedure)

Would you be willing to take a look?  I think it would be embarrassing
to release Guix 1.0 with a documented service that has never been
tested.  What do you think?

      Regards,
        Mark

Re: Trouble getting 'fprintd-service-type' to work

[Danny Milosavljevic]

[-- Attachment #1: Type: text/plain, Size: 1306 bytes --]

Hi Mark,

On Sat, 20 Apr 2019 16:21:44 -0400
Mark H Weaver <mhw@netris.org> wrote:

> Thanks, but did you test that it actually works in practice?
> 
> I strongly suspect that it still won't work.  According to
> <https://wiki.archlinux.org/index.php/Fprint>, the 'pam_fprintd.so'
> module needs to be added to the PAM configuration.

That is only required if not using gdm.  I think since we force gdm now it
should work as-is.

> So, I guess we also need something along the lines of the following,
> which is used in 'elogind-service-type' in (gnu services desktop):
> 
>                        ;; Extend PAM with pam_fprintd.so.
>                        (service-extension pam-root-service-type
>                                           pam-extension-procedure)

Yes, but we'd have to amend the etc/pam.d/login file and that
would mean we'd have to add an entire authentication configuration
mechanism to guix (where to allow fingerprint authentication
and where not to allow it is a policy decision done by the
system administrator and should not be hard-coded).

I've found one comment "./sddm.scm: ;; should be factored out into
system-auth" that maybe suggests such a guix configuration already
exists somewhere, but I can't find it.

I'm not sure how to proceed.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Trouble getting 'fprintd-service-type' to work

[Tobias Geerinckx-Rice]

[-- Attachment #1: Type: text/plain, Size: 1035 bytes --]

Danny, all,

Danny Milosavljevic wrote:
>> I strongly suspect that it still won't work.  According to
>> <https://wiki.archlinux.org/index.php/Fprint>, the 
>> 'pam_fprintd.so'
>> module needs to be added to the PAM configuration.
>
> That is only required if not using gdm.  I think since we force 
> gdm now it
> should work as-is.

What do you mean?  We don't force GDM on anyone.

I'm still unable to use fprintd at all (I think, I've never used 
it before):

  ~ λ fprintd-enroll nckx
  Using device /net/reactivated/Fprint/Device/0
  failed to claim device: Not Authorized:
    GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed:
    Action net.reactivated.fprint.device.enroll is not registered
  ~ λ sudo fprintd-enroll nckx
  Using device /net/reactivated/Fprint/Device/0
  failed to claim device: Not Authorized:
    GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed:
    Action net.reactivated.fprint.device.setusername is not 
    registered

I'm not using GDM.

Kind regards,

T G-R

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]

Re: Trouble getting 'fprintd-service-type' to work

[Danny Milosavljevic]

[-- Attachment #1: Type: text/plain, Size: 1180 bytes --]

Hi,

Wed, 24 Apr 2019 20:41:16 +0200
Tobias Geerinckx-Rice <me@tobias.gr> wrote:

> What do you mean?  We don't force GDM on anyone.

My config has slim-service-type and no mention of "gdm" anywhere (unchanged
for more than a year).
I suddenly got gdm when I did "guix system reconfigure"--and it didn't work
to login.  Slim was gone on reboot.
That's why I was fixing gdm in the last few days (bug# 35377).

> I'm still unable to use fprintd at all (I think, I've never used 
> it before):
> 
>   ~ λ fprintd-enroll nckx
>   Using device /net/reactivated/Fprint/Device/0
>   failed to claim device: Not Authorized:
>     GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed:
>     Action net.reactivated.fprint.device.enroll is not registered
>   ~ λ sudo fprintd-enroll nckx
>   Using device /net/reactivated/Fprint/Device/0
>   failed to claim device: Not Authorized:
>     GDBus.Error:org.freedesktop.PolicyKit1.Error.Failed:
>     Action net.reactivated.fprint.device.setusername is not 
>     registered

Yeah, seems that it also needs a polkit extension.
I've added it to guix master now, as
commit 9374cbd1fb29395a5e849e95e8a249e5f9f944c0.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]