In search of contributors to a Linux Chromebook fingerprint PAM module

It is working well so far. It survives reboots.

I haven’t dived into SDDM login, I am on KDE neon. I’ll guess it will have its own Ubuntu and neon specific quirks, but I personally don’t care about login so much.

@ChocolateLoverRaj
I now have a working prototype for a libfprint driver.

What works (tested on an Jinlon device):

  • enrolling and saving prints
  • verifying/identifying prints
  • uploading prints after sensor reset

What needs to be done:

  • driver still allows more than the allowed number of prints to be enrolled (additional prints won’t crash; they just won’t work silently)
  • driver needs to enforce protocol version v1 since v0 lacks the required features
  • proper error handling
  • cleanup of code (fine-tune sleeps to reduce delay, etc …)

I would be glad if people could test this release.

For NixOS users to test with a desktop:

  nixpkgs.overlays = [

    (self: super: {
      libfprint = super.libfprint.overrideAttrs (oldAttrs: rec {
        src = pkgs.fetchFromGitHub {
          owner = "Xelef2000";
          repo = "libfprint";
          rev = "1821b98e7e4db05302b41b40ae628842c93169b6";
          hash = "sha256-gvJJY8uVkPn8ASkqh4qE+SSqStnYlLVrcUITilQPf6U=";
        };
      });
    })
  ];

  services.fprintd.enable = true;

There is also a nix flake in the branch, this can be used to compile the driver manually.
Which allows for the usage of the example programs. Those example programs provider a lot of debug information.

For users of other distros.
Download the source code and compile the driver by hand.
I think using the included example programs would be best for testing.

I use NixOS and I tested it just now (with 5 fingers). It works, including after suspend. I will let you know if it works after a restart.

This project is very promising, great work! The fingerprint sensor worked just fine for me, I tested using Morphius with Arch. I could only really test it in the command line utility since I couldn’t get it working with Cinnamon. But I briefly installed Plasma to take a look at it there and it works well. It’d be cool if I could use it with sudo in the terminal, as well as polkit, instead of just being for the KDE login screen. Unfortunately idk how much I can contribute to this because I’m not much of a developer but I will be keeping an eye on this as it develops.

I would recommend using the libfprint merge request that @Xelef2000 made since libfprint is better integrated with DEs. You would just have to build it from source.

Yes I did see that there, it was like 5 AM for me so I had to get some sleep lol. But I’ll take a look at that today

I should mention that rust-fp does actually work on the cinnamon lock screen, just adding librust_fp_pam_module.so to /etc/pam.d/cinnamon-screensaver works fine. It does not have any GUI asking for a fingerprint but it does unlock.
Outside of that though if I try to use it with /etc/pam.d/sudo or /etc/pam.d/lightdm (lightdm just outputs the last line here) I get an error:

thread '<unnamed>' panicked at pam-module/src/wait_until_unlock.rs:8:73:
called `Result::unwrap()` on an `Err` value: InputOutput(Os { code: 2, kind: NotFound, message: "No such file or directory" })
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
No templates saved. Not matching.

rust-fp also does not persist after reboot for me (at least on Morphius), I have to clear and make a new template for it to work. I have seen this previously reported but I haven’t seen this error mentioned:

$ rust-fp match
Ready to match...
Error: Failed("\"Error uploading template: Response(Unavailable)\"")

The error pops up pretty much immediately after running the command, but I’m wondering if perhaps I missed something from the instructions or if I’ve done something wrong? Which if that’s the case that’s completely on me lol. I may try dual booting with NixOS to see if it works better on there, as well as the the libfprint driver which I couldn’t get working on Arch. But let me know if there’s other logs I could provide to help with debugging.

I’m having some issues with this on my hp pro c640 ‘dratini’

sudo ./ectool --name=cros_fp fpseed aaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaa
Unable to establish host communication
Couldn't find EC
sudo ./ectool fpseed aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Setting seed 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
EC result 1 (INVALID_COMMAND)

I can only assume that the sensor is hooked up weirdly on this maching I think, it’s not a usb device either. It is listed in the docs as ‘fingerprint reader doesn’t work’ but I was hoping this would make it work.

Does /dev/cros_fp exist?

Nope I guess that explains it :frowning: I guess the note in the docs remains correct

Very interesting. I am now on fedora 41 with cinnamon desktop. Rust-fp per se works: I mean I can save and match fingerprints. But I can’t figure how to use it to unlock the screensaver.

The module is in the correct folder and I have also appended

auth sufficient librust_fp_pam_module.so
account sufficient librust_fp_pam_module.so

to cinnamon-screensaver but it doesn’t let me unlock anything.

Will you share your steps, please?

Nevermind, I had just got to put the code at the beginning of the file and not at the end:)

This code works and gives me the double choice to unlock with the password or with my fingerprint

auth sufficient pam_unix.so first_try_pass likeauth nullok
auth sufficient librust_fp_pam_module.so
account sufficient librust_fp_pam_module.so

I went further and inserted the same lines in /etc/pam.d/sudo

Then I typed enter in order to use sudo auth with my fingerprint and I got this

❯ sudo nano sudo
[sudo] password di USER:
thread ‘’ panicked at pam-module/src/wait_until_unlock.rs:8:73:
called Result::unwrap() on an Err value: InputOutput(Os { code: 2, kind: NotFound, message: “File o directory non esistente” })
note: run with RUST_BACKTRACE=1 environment variable to display a backtrace
No templates saved. Not matching.
thread ‘’ panicked at pam-module/src/lib.rs:49:10:
called Result::unwrap() on an Err value: MultipleHandlers
thread ‘’ panicked at core/src/panicking.rs:221:5:
panic in a function that cannot unwind
stack backtrace:
0: 0x7fcc72cd6d0a - <std::sys::backtrace::BacktraceLock::print::DisplayBacktrace as core::fmt::Display>::fmt::hddb63c9699c7309a
1: 0x7fcc72cfac33 - core::fmt::write::hc338d61058c0d66c
2: 0x7fcc72cd3563 - std::io::Write::write_fmt::h80dab97476750852
3: 0x7fcc72cd6b52 - std::sys::backtrace::BacktraceLock::print::h8f82e207cdd02441
4: 0x7fcc72cd7c3c - std::panicking::default_hook::{{closure}}::hced8387e9fe5d421
5: 0x7fcc72cd7a82 - std::panicking::default_hook::ha3f6ad90792a97b6
6: 0x7fcc72cd8217 - std::panicking::rust_panic_with_hook::h061c0c1eebc4ec34
7: 0x7fcc72cd8076 - std::panicking::begin_panic_handler::{{closure}}::h5e30b0d14d1187f1
8: 0x7fcc72cd71e9 - std::sys::backtrace::__rust_end_short_backtrace::h5df085eb7f7be6aa
9: 0x7fcc72cd7d3c - rust_begin_unwind
10: 0x7fcc72a1353d - core::panicking::panic_nounwind_fmt::h42fb6c9fcc51315f
11: 0x7fcc72a135d2 - core::panicking::panic_nounwind::hef94e2827ea9c9b0
12: 0x7fcc72a13695 - core::panicking::panic_cannot_unwind::hbb4894eea11007a2
13: 0x7fcc72ad0cd9 - pam_sm_authenticate
14: 0x7fcc811dfc6f -
15: 0x7fcc811e0478 - pam_authenticate
16: 0x7fcc7337cb8b -
17: 0x7fcc733c505e -
18: 0x7fcc733c6a95 -
19: 0x7fcc7338eb53 -
20: 0x563660e25a2e -
21: 0x563660e11c1f -
22: 0x7fcc8120f248 - __libc_start_call_main
23: 0x7fcc8120f30b - __libc_start_main_alias_1
24: 0x563660e14025 -
25: 0x0 -
thread caused non-unwinding panic. aborting.
zsh: IOT instruction (core dumped) sudo nano sudo

I am not sure how useful it might be.

I think this error is in some code that I wrote that may only work for KDE. Please create an issue on Issues · ChocolateLoverRaj/rust-fp · GitHub.

You might have a smoother experience with https://gitlab.freedesktop.org/libfprint/libfprint/-/merge_requests/512. I have been using it on GNOME and it works.

Thanks for the feedback, I opened the issue.

I know there’s an alternative, but your rust-fp works very well and I already know how to configure the build environment, so I am a bit lazy!