Compare commits
No commits in common. "main" and "v0.4.1" have entirely different histories.
@ -1,43 +0,0 @@
|
||||
# ABOUTME: Updates pkgver in moonarch-pkgbuilds after a push to main.
|
||||
# ABOUTME: Ensures paru detects new versions of this package.
|
||||
|
||||
name: Update PKGBUILD version
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
jobs:
|
||||
update-pkgver:
|
||||
runs-on: moonarch
|
||||
steps:
|
||||
- name: Checkout source repo
|
||||
run: |
|
||||
git clone --bare http://gitea:3000/nevaforget/moonlock.git source.git
|
||||
cd source.git
|
||||
PKGVER=$(git describe --long --tags | sed 's/^v//;s/-/.r/;s/-/./')
|
||||
echo "New pkgver: $PKGVER"
|
||||
echo "$PKGVER" > /tmp/pkgver
|
||||
|
||||
- name: Update PKGBUILD
|
||||
run: |
|
||||
PKGVER=$(cat /tmp/pkgver)
|
||||
git clone http://gitea:3000/nevaforget/moonarch-pkgbuilds.git pkgbuilds
|
||||
cd pkgbuilds
|
||||
|
||||
OLD_VER=$(grep '^pkgver=' moonlock-git/PKGBUILD | cut -d= -f2)
|
||||
if [ "$OLD_VER" = "$PKGVER" ]; then
|
||||
echo "pkgver already up to date ($PKGVER)"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
sed -i "s/^pkgver=.*/pkgver=$PKGVER/" moonlock-git/PKGBUILD
|
||||
sed -i "s/^\tpkgver = .*/\tpkgver = $PKGVER/" moonlock-git/.SRCINFO
|
||||
echo "Updated pkgver: $OLD_VER → $PKGVER"
|
||||
|
||||
git config user.name "pkgver-bot"
|
||||
git config user.email "gitea@moonarch.de"
|
||||
git add moonlock-git/PKGBUILD moonlock-git/.SRCINFO
|
||||
git commit -m "chore(moonlock-git): bump pkgver to $PKGVER"
|
||||
git -c http.extraHeader="Authorization: token ${{ secrets.PKGBUILD_TOKEN }}" push
|
||||
29
CLAUDE.md
29
CLAUDE.md
@ -1,5 +1,7 @@
|
||||
# Moonlock
|
||||
|
||||
**Name**: Nyx (Göttin der Nacht — passend zum Lockscreen, der den Bildschirm verdunkelt)
|
||||
|
||||
## Projekt
|
||||
|
||||
Moonlock ist ein sicherer Wayland-Lockscreen, gebaut mit Rust + gtk4-rs + ext-session-lock-v1.
|
||||
@ -17,7 +19,7 @@ Teil des Moonarch-Ökosystems.
|
||||
## Projektstruktur
|
||||
|
||||
- `src/` — Rust-Quellcode (main.rs, lockscreen.rs, auth.rs, fingerprint.rs, config.rs, i18n.rs, users.rs, power.rs)
|
||||
- `resources/` — GResource-Assets (style.css, default-avatar.svg)
|
||||
- `resources/` — GResource-Assets (style.css, wallpaper.jpg, default-avatar.svg)
|
||||
- `config/` — PAM-Konfiguration und Beispiel-Config
|
||||
|
||||
## Kommandos
|
||||
@ -35,28 +37,23 @@ LD_PRELOAD=/usr/lib/libgtk4-layer-shell.so ./target/release/moonlock
|
||||
|
||||
## Architektur
|
||||
|
||||
- `auth.rs` — PAM-Authentifizierung via Raw FFI (unsafe extern "C" conv callback, msg_style-aware, Zeroizing<CString>), check_account() für pam_acct_mgmt-Only-Checks nach Fingerprint-Unlock
|
||||
- `fingerprint.rs` — fprintd D-Bus Listener, async init/claim/verify via gio futures, sender-validated signal handler, cleanup_dbus() für sauberen D-Bus-Lifecycle, running_flag für Race-Safety in async restarts, on_exhausted callback after MAX_FP_ATTEMPTS, resume_async() für Neustart nach transientem Fehler (mit failed_attempts-Reset und Signal-Handler-Cleanup)
|
||||
- `auth.rs` — PAM-Authentifizierung via Raw FFI (unsafe extern "C" conv callback, msg_style-aware, Zeroizing<Vec<u8>>)
|
||||
- `fingerprint.rs` — fprintd D-Bus Listener (Rc<RefCell<FingerprintListener>>, self-wiring g-signal via connect_local)
|
||||
- `users.rs` — Aktuellen User via nix getuid, Avatar-Loading mit Symlink-Rejection
|
||||
- `power.rs` — Reboot/Shutdown via /usr/bin/systemctl
|
||||
- `i18n.rs` — Locale-Erkennung (OnceLock-cached) und String-Tabellen (DE/EN), faillock_warning mit konfigurierbarem max_attempts
|
||||
- `config.rs` — TOML-Config (background_path, background_blur clamped [0,200], fingerprint_enabled als Option<bool>) + Wallpaper-Fallback + Symlink-Rejection via symlink_metadata + Parse-Error-Logging
|
||||
- `lockscreen.rs` — GTK4 UI via LockscreenHandles, PAM-Auth via gio::spawn_blocking mit 30s Timeout und Generation Counter, FP-Label/Start separat verdrahtet mit pam_acct_mgmt-Check und auto-resume, Zeroizing<String> für Passwort, Power-Confirm, GPU-Blur via GskBlurNode (Downscale auf max 1920px), Blur/Avatar-Cache für Multi-Monitor
|
||||
- `main.rs` — Entry Point, Panic-Hook (vor Logging), Root-Check, ext-session-lock-v1 (Pflicht in Release), Monitor-Hotplug via `connect_monitor`-Signal (v1_2), shared Blur/Avatar-Caches in Rc, systemd-Journal-Logging, Debug-Level per `MOONLOCK_DEBUG` Env-Var, async fprintd-Init nach window.present()
|
||||
- `power.rs` — Reboot/Shutdown via /usr/bin/loginctl
|
||||
- `i18n.rs` — Locale-Erkennung und String-Tabellen (DE/EN), faillock_warning mit konfigurierbarem max_attempts
|
||||
- `config.rs` — TOML-Config (background_path, fingerprint_enabled als Option<bool>) + Wallpaper-Fallback
|
||||
- `lockscreen.rs` — GTK4 UI, PAM-Auth via gio::spawn_blocking, Fingerprint-Indikator, Zeroizing<String> für Passwort, Power-Confirm
|
||||
- `main.rs` — Entry Point, Panic-Hook, Root-Check, ext-session-lock-v1 (Pflicht in Release), Multi-Monitor
|
||||
|
||||
## Sicherheit
|
||||
|
||||
- ext-session-lock-v1 garantiert: Compositor sperrt alle Surfaces bei lock()
|
||||
- Release-Build: Ohne ext-session-lock-v1 wird `exit(1)` aufgerufen — kein Fenster-Fallback
|
||||
- Panic-Hook: Bei Crash wird geloggt, aber NIEMALS unlock() aufgerufen — Screen bleibt schwarz. Hook wird vor Logging installiert.
|
||||
- PAM-Callback: msg_style-aware (Passwort nur bei PAM_PROMPT_ECHO_OFF), strdup-OOM-sicher, num_msg-Guard gegen negative Werte
|
||||
- fprintd: D-Bus Signal-Sender wird gegen fprintd's unique bus name validiert (Anti-Spoofing)
|
||||
- Passwort: Zeroizing<String> ab GTK-Entry-Extraktion, Zeroizing<CString> im PAM-FFI-Layer (bekannte Einschränkung: GLib-GString und strdup-Kopie in PAM werden nicht gezeroized — inhärente GTK/libc-Limitierung)
|
||||
- Fingerprint-Unlock: pam_acct_mgmt-Check nach verify-match erzwingt Account-Policies (Lockout, Ablauf), resume_async() startet FP bei transientem Fehler neu (mit failed_attempts-Reset und Signal-Handler-Cleanup)
|
||||
- Wallpaper wird vor lock() geladen — connect_monitor feuert während lock() und braucht die Textur; lokales JPEG-Laden ist schnell genug
|
||||
- PAM-Timeout: 30s Timeout verhindert permanentes Aussperren bei hängenden PAM-Modulen, Generation Counter verhindert Interferenz paralleler Auth-Versuche
|
||||
- Panic-Hook: Bei Crash wird geloggt, aber NIEMALS unlock() aufgerufen — Screen bleibt schwarz
|
||||
- PAM-Callback: msg_style-aware (Passwort nur bei PAM_PROMPT_ECHO_OFF), strdup-OOM-sicher
|
||||
- Passwort: Zeroizing<String> ab GTK-Entry-Extraktion, Zeroizing<Vec<u8>> im PAM-FFI-Layer
|
||||
- Root-Check: Exit mit Fehler wenn als root gestartet
|
||||
- Faillock: UI-Warnung nach 3 Fehlversuchen, aber PAM entscheidet über Lockout (Entry bleibt aktiv)
|
||||
- Kein Schließen per Escape/Alt-F4 — nur durch erfolgreiche PAM-Auth oder Fingerprint
|
||||
- Peek-Icon am Passwortfeld aktiv (UX-Entscheidung, konsistent mit moongreet)
|
||||
- GResource-Bundle: CSS/Assets in der Binary kompiliert
|
||||
|
||||
189
Cargo.lock
generated
189
Cargo.lock
generated
@ -2,6 +2,65 @@
|
||||
# It is not intended for manual editing.
|
||||
version = 4
|
||||
|
||||
[[package]]
|
||||
name = "aho-corasick"
|
||||
version = "1.1.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
|
||||
dependencies = [
|
||||
"memchr",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "anstream"
|
||||
version = "1.0.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
|
||||
dependencies = [
|
||||
"anstyle",
|
||||
"anstyle-parse",
|
||||
"anstyle-query",
|
||||
"anstyle-wincon",
|
||||
"colorchoice",
|
||||
"is_terminal_polyfill",
|
||||
"utf8parse",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "anstyle"
|
||||
version = "1.0.14"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
|
||||
|
||||
[[package]]
|
||||
name = "anstyle-parse"
|
||||
version = "1.0.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
|
||||
dependencies = [
|
||||
"utf8parse",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "anstyle-query"
|
||||
version = "1.1.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
|
||||
dependencies = [
|
||||
"windows-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "anstyle-wincon"
|
||||
version = "3.0.11"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
|
||||
dependencies = [
|
||||
"anstyle",
|
||||
"once_cell_polyfill",
|
||||
"windows-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "anyhow"
|
||||
version = "1.0.102"
|
||||
@ -65,6 +124,35 @@ version = "0.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
|
||||
|
||||
[[package]]
|
||||
name = "colorchoice"
|
||||
version = "1.0.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
|
||||
|
||||
[[package]]
|
||||
name = "env_filter"
|
||||
version = "1.0.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "32e90c2accc4b07a8456ea0debdc2e7587bdd890680d71173a15d4ae604f6eef"
|
||||
dependencies = [
|
||||
"log",
|
||||
"regex",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "env_logger"
|
||||
version = "0.11.10"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0621c04f2196ac3f488dd583365b9c09be011a4ab8b9f37248ffcc8f6198b56a"
|
||||
dependencies = [
|
||||
"anstream",
|
||||
"anstyle",
|
||||
"env_filter",
|
||||
"jiff",
|
||||
"log",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "equivalent"
|
||||
version = "1.0.2"
|
||||
@ -522,12 +610,42 @@ dependencies = [
|
||||
"serde_core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "is_terminal_polyfill"
|
||||
version = "1.70.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
|
||||
|
||||
[[package]]
|
||||
name = "itoa"
|
||||
version = "1.0.18"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
|
||||
|
||||
[[package]]
|
||||
name = "jiff"
|
||||
version = "0.2.23"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1a3546dc96b6d42c5f24902af9e2538e82e39ad350b0c766eb3fbf2d8f3d8359"
|
||||
dependencies = [
|
||||
"jiff-static",
|
||||
"log",
|
||||
"portable-atomic",
|
||||
"portable-atomic-util",
|
||||
"serde_core",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "jiff-static"
|
||||
version = "0.2.23"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2a8c8b344124222efd714b73bb41f8b5120b27a7cc1c75593a6ff768d9d05aa4"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "khronos_api"
|
||||
version = "3.1.0"
|
||||
@ -575,21 +693,20 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "moonlock"
|
||||
version = "0.6.12"
|
||||
version = "0.4.0"
|
||||
dependencies = [
|
||||
"env_logger",
|
||||
"gdk-pixbuf",
|
||||
"gdk4",
|
||||
"gio",
|
||||
"glib",
|
||||
"glib-build-tools",
|
||||
"graphene-rs",
|
||||
"gtk4",
|
||||
"gtk4-session-lock",
|
||||
"libc",
|
||||
"log",
|
||||
"nix",
|
||||
"serde",
|
||||
"systemd-journal-logger",
|
||||
"tempfile",
|
||||
"toml 0.8.23",
|
||||
"zeroize",
|
||||
@ -613,6 +730,12 @@ version = "1.21.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
|
||||
|
||||
[[package]]
|
||||
name = "once_cell_polyfill"
|
||||
version = "1.70.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
|
||||
|
||||
[[package]]
|
||||
name = "pango"
|
||||
version = "0.22.0"
|
||||
@ -649,6 +772,21 @@ version = "0.3.32"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
|
||||
|
||||
[[package]]
|
||||
name = "portable-atomic"
|
||||
version = "1.13.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
|
||||
|
||||
[[package]]
|
||||
name = "portable-atomic-util"
|
||||
version = "0.2.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "091397be61a01d4be58e7841595bd4bfedb15f1cd54977d79b8271e94ed799a3"
|
||||
dependencies = [
|
||||
"portable-atomic",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "prettyplease"
|
||||
version = "0.2.37"
|
||||
@ -692,6 +830,35 @@ version = "6.0.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
|
||||
|
||||
[[package]]
|
||||
name = "regex"
|
||||
version = "1.12.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
|
||||
dependencies = [
|
||||
"aho-corasick",
|
||||
"memchr",
|
||||
"regex-automata",
|
||||
"regex-syntax",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "regex-automata"
|
||||
version = "0.4.14"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
|
||||
dependencies = [
|
||||
"aho-corasick",
|
||||
"memchr",
|
||||
"regex-syntax",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "regex-syntax"
|
||||
version = "0.8.10"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
|
||||
|
||||
[[package]]
|
||||
name = "rustc_version"
|
||||
version = "0.4.1"
|
||||
@ -817,16 +984,6 @@ dependencies = [
|
||||
"version-compare",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "systemd-journal-logger"
|
||||
version = "2.2.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7266304d24ca5a4b230545fc558c80e18bd3e1d2eb1be149b6bcd04398d3e79c"
|
||||
dependencies = [
|
||||
"log",
|
||||
"rustix",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "target-lexicon"
|
||||
version = "0.13.3"
|
||||
@ -959,6 +1116,12 @@ version = "0.2.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
|
||||
|
||||
[[package]]
|
||||
name = "utf8parse"
|
||||
version = "0.2.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
|
||||
|
||||
[[package]]
|
||||
name = "version-compare"
|
||||
version = "0.2.1"
|
||||
|
||||
14
Cargo.toml
14
Cargo.toml
@ -1,33 +1,27 @@
|
||||
[package]
|
||||
name = "moonlock"
|
||||
version = "0.6.12"
|
||||
version = "0.4.1"
|
||||
edition = "2024"
|
||||
description = "A secure Wayland lockscreen with GTK4, PAM and fingerprint support"
|
||||
license = "MIT"
|
||||
|
||||
[dependencies]
|
||||
gtk4 = { version = "0.11", features = ["v4_10"] }
|
||||
gtk4-session-lock = { version = "0.4", features = ["v1_2"] }
|
||||
gtk4-session-lock = { version = "0.4", features = ["v1_1"] }
|
||||
glib = "0.22"
|
||||
gdk4 = "0.11"
|
||||
gdk-pixbuf = "0.22"
|
||||
gio = "0.22"
|
||||
toml = "0.8"
|
||||
serde = { version = "1", features = ["derive"] }
|
||||
graphene-rs = { version = "0.22", package = "graphene-rs" }
|
||||
nix = { version = "0.29", features = ["user"] }
|
||||
zeroize = { version = "1", features = ["derive", "std"] }
|
||||
zeroize = { version = "1", features = ["derive"] }
|
||||
libc = "0.2"
|
||||
log = "0.4"
|
||||
systemd-journal-logger = "2.2"
|
||||
env_logger = "0.11"
|
||||
|
||||
[dev-dependencies]
|
||||
tempfile = "3"
|
||||
|
||||
[build-dependencies]
|
||||
glib-build-tools = "0.22"
|
||||
|
||||
[profile.release]
|
||||
lto = "fat"
|
||||
codegen-units = 1
|
||||
strip = true
|
||||
|
||||
87
DECISIONS.md
87
DECISIONS.md
@ -1,87 +0,0 @@
|
||||
# Decisions
|
||||
|
||||
Architectural and design decisions for Moonlock, in reverse chronological order.
|
||||
|
||||
## 2026-04-24 – Audit LOW fixes: docs, rustdoc, check_account scope, debug gating, lto fat (v0.6.12)
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Six LOW findings cleared in a single pass. (1) Docs referenced the old `[0,100]` blur range; code clamps `[0,200]` since v0.6.8. (2) The `MAX_BLUR_DIMENSION` doc comment was split by a `// SYNC:` block, producing a truncated sentence in rustdoc. (3) `check_account` was `pub` and relied on callers only ever passing `getuid()`-derived usernames; the contract was not enforced by the type system. (4) `MOONLOCK_DEBUG` env var flipped log verbosity to Debug in release builds, letting a compromised session script escalate journal noise about fprintd / D-Bus. (5) `pam_setcred` absence was undocumented. (6) `[profile.release]` used `lto = "thin"` — fine for most crates, but for a latency-critical auth binary compiled once per release, fat LTO's extra cross-crate inlining is worth the ~1 min build hit.
|
||||
- **Tradeoffs**: `lto = "fat"` roughly doubles release build time (~30 s → ~60 s) for slightly better inlining across PAM FFI wrappers and the i18n/status paths. `#[cfg(debug_assertions)]` on the debug-level selector means you have to run a debug build to raise log level — inconvenient for live troubleshooting, but aligned with the security-first posture.
|
||||
- **How**: (1) `CLAUDE.md` + `README.md` updated to `[0,200]`. (2) `// SYNC:` block moved above the `///` doc so rustdoc renders one coherent paragraph. (3) `check_account` visibility narrowed to `pub(crate)` with a `Precondition` paragraph explaining the username contract. (4) Debug-level selection wrapped in `#[cfg(debug_assertions)]`; release builds always run at `LevelFilter::Info`. (5) Added a comment block in `authenticate()` documenting why `pam_setcred` is deliberately absent and where it would hook in if needed. (6) `lto = "fat"` in `Cargo.toml`.
|
||||
|
||||
## 2026-04-24 – Audit MEDIUM fixes: D-Bus cleanup race, TOCTOU open, FP reset, GTK entry clear (v0.6.11)
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Second round after the HIGH fixes, addressing the four MEDIUM findings. (1) `cleanup_dbus` spawned VerifyStop + Release as fire-and-forget, then `resume_async` called Claim after only a 2 s timeout — shorter than the 3 s D-Bus timeout, so on a slow bus the Claim could race the Release and fprintd would reject it, leaving the FP listener permanently dead. (2) `load_background_texture` relied on the caller's `symlink_metadata` check, re-opening the path via `gdk::Texture::from_file` — a classic TOCTOU window. (3) `resume_async` unconditionally reset `failed_attempts`, allowing an attacker with sensor control to evade the 10-attempt cap by cycling verify-match → `check_account` fail → resume. (4) The GTK `PasswordEntry` buffer was only cleared on timeout or auth failure, leaving the password in GLib malloc'd memory longer than necessary.
|
||||
- **Tradeoffs**: The D-Bus cleanup is now split into a synchronous helper (`take_cleanup_proxy` — signal disconnect + flag clear) and an async helper (`perform_dbus_cleanup` — VerifyStop + Release), so `resume_async` can await the release while `stop()` stays fire-and-forget. Dropping the `failed_attempts` reset means a flaky sensor could reach 10 failures faster, but the correct remedy is a new lock session (construction) rather than a reset that also helps attackers.
|
||||
- **How**: (1) Split `cleanup_dbus` into `take_cleanup_proxy()` (sync) + `perform_dbus_cleanup(proxy)` (async). `resume_async` now awaits `perform_dbus_cleanup` before `begin_verification`. `stop()` still spawns the cleanup fire-and-forget. (2) `load_background_texture` opens with `O_NOFOLLOW` via `std::fs::OpenOptions::custom_flags`, reads to bytes, and builds the texture via `gdk::Texture::from_bytes`. (3) Removed `listener.borrow_mut().failed_attempts = 0` from `resume_async`. (4) `password_entry.set_text("")` now fires right after the `Zeroizing::new(entry.text().to_string())` extraction, shortening the GTK-side window.
|
||||
|
||||
## 2026-04-24 – Audit fixes: RefCell borrow across await, async avatar decode
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Triple audit found two HIGH issues. (1) `init_fingerprint_async` held a `RefCell` immutable borrow across `is_available_async().await` — a concurrent `connect_monitor` signal (hotplug / suspend-resume) invoking `borrow_mut()` during the await would panic. (2) `set_avatar_from_file` decoded avatars synchronously via `Pixbuf::from_file_at_scale`, blocking the GTK main thread inside the `connect_monitor` handler. With `MAX_AVATAR_FILE_SIZE` at 10 MB the worst-case stall was 200–500 ms on monitor hotplug.
|
||||
- **Tradeoffs**: Avatar is shown as the symbolic default icon for a brief window while decoding completes. Wallpaper stays synchronous because `connect_monitor` fires during `lock()` and needs the texture already present (see 2026-04-09).
|
||||
- **How**: (1) Extract `username` into a local `String` in `init_fingerprint_async`, drop the borrow before the await, re-borrow in a new scope after — no awaits inside the second borrow, so hotplug during signal setup is safe. (2) `set_avatar_from_file` now uses `gio::File::read_future` + `Pixbuf::from_stream_at_scale_future` for async I/O and decode. The default icon is shown immediately; the decoded texture replaces it when ready. `Pixbuf` itself is `!Send`, so `gio::spawn_blocking` does not apply — the GIO async stream loader keeps the `Pixbuf` on the main thread while the kernel does the I/O asynchronously.
|
||||
|
||||
## 2026-04-09 – Monitor hotplug via connect_monitor signal
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: moonlock crashed with segfault in libgtk-4.so after suspend/resume — HDMI monitor disconnect/reconnect invalidated GDK monitor objects, and the statically created windows referenced destroyed surfaces. Crash at consistent GTK4 offset (0x278 NULL dereference), 3x reproduced.
|
||||
- **Tradeoffs**: Wallpaper texture now loaded before `lock()` instead of after (connect_monitor fires during lock() and needs the texture). Local JPEG loading is fast enough that the delay is negligible. Shared state moved to Rc's for the signal closure — slightly more indirection but necessary for dynamic window creation.
|
||||
- **How**: (1) Bump gtk4-session-lock feature from `v1_1` to `v1_2` to enable `Instance::connect_monitor`. (2) Replace manual monitor iteration with `lock.connect_monitor()` signal handler that creates windows on demand. (3) Signal fires once per existing monitor at `lock()` and again on hotplug. (4) Windows auto-unmap when their monitor disappears (ext-session-lock-v1 guarantee). (5) Fingerprint listener published to shared Rc so hotplugged monitors get FP labels.
|
||||
|
||||
## 2026-03-31 – Fourth audit: peek icon, blur limit, GResource compression, sync markers
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Fourth triple audit found blur limit inconsistency (moonlock 0–100 vs moongreet/moonset 0–200), missing GResource compression, peek icon inconsistency, and duplicated code without sync markers.
|
||||
- **Tradeoffs**: Peek icon enabled in lockscreen — user decision favoring UX consistency over shoulder-surfing protection. Acceptable for single-user desktop. Blur limit raised to 200 for ecosystem consistency.
|
||||
- **How**: (1) `show_peek_icon(true)` in lockscreen password entry. (2) `clamp(0.0, 200.0)` for blur in config.rs. (3) `compressed="true"` on CSS/SVG GResource entries. (4) SYNC comments on duplicated blur/background functions pointing to moongreet and moonset.
|
||||
|
||||
## 2026-03-30 – Third audit: blur offset, lock-before-IO, FP signal lifecycle, TOCTOU
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Third triple audit (quality, performance, security) found: blur padding offset rendering texture at (0,0) instead of (-pad,-pad) causing edge darkening on left/top (BUG), wallpaper disk I/O blocking before lock() extending the unsecured window (PERF/SEC), signal handler duplication on resume_async (SEC), failed_attempts not reset on FP resume (SEC), unknown VerifyStatus with done=false hanging FP listener (SEC), TOCTOU in is_file+is_symlink checks (SEC), dead code in faillock_warning (QUALITY), unbounded blur sigma (SEC).
|
||||
- **Tradeoffs**: Wallpaper loads after lock() — screen briefly shows without wallpaper until texture is ready. Acceptable: security > aesthetics. Blur sigma clamped to [0.0, 100.0] — arbitrary upper bound but prevents GPU memory exhaustion.
|
||||
- **How**: (1) Texture offset to (-pad, -pad) in render_blurred_texture. (2) lock.lock() before resolve_background_path. (3) begin_verification disconnects old signal_id before registering new. (4) resume_async resets failed_attempts. (5) Unknown VerifyStatus with done=true triggers restart. (6) symlink_metadata() for atomic file+symlink check. (7) faillock_warning dead code removed, saturating_sub. (8) background_blur clamped. (9) Redundant Zeroizing<Vec<u8>> removed. (10) Default impl for FingerprintListener. (11) on_verify_status restricted to pub(crate). (12) Warn logging for non-UTF-8 GECOS and avatar paths.
|
||||
|
||||
## 2026-03-30 – Second audit: zeroize CString, FP account check, PAM timeout, blur downscale
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Second triple audit (quality, performance, security) found: CString password copy not zeroized (HIGH), fingerprint unlock bypassing pam_acct_mgmt (MEDIUM), no PAM timeout leaving user locked out on hanging modules (MEDIUM), GPU blur on full wallpaper resolution (MEDIUM), no-monitor edge case doing `return` instead of `exit(1)` (MEDIUM).
|
||||
- **Tradeoffs**: PAM timeout (30s) uses a generation counter to avoid stale result interference — adds complexity but prevents parallel PAM sessions. FP restart after failed account check re-claims the device, adding a D-Bus round-trip, but prevents permanent FP death on transient failures. Blur downscale to 1920px cap trades negligible quality for ~4x less GPU work on 4K wallpapers.
|
||||
- **How**: (1) `Zeroizing<CString>` wraps password in auth.rs, `zeroize/std` feature enabled. (2) `check_account()` calls pam_acct_mgmt after FP match; `resume_async()` restarts FP on transient failure. (3) `auth_generation` counter invalidates stale PAM results; 30s timeout re-enables UI. (4) `MAX_BLUR_DIMENSION` caps blur input at 1920px, sigma scaled proportionally. (5) `exit(1)` on no-monitor after `lock.lock()`.
|
||||
|
||||
## 2026-03-28 – Remove embedded wallpaper from binary
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Wallpaper is installed by moonarch to /usr/share/moonarch/wallpaper.jpg. Embedding a 374K JPEG in the binary is redundant. GTK background color (Catppuccin Mocha base) is a clean fallback.
|
||||
- **Tradeoffs**: Without moonarch installed AND without config, lockscreen shows plain dark background instead of wallpaper. Acceptable — that's the expected minimal state.
|
||||
- **How**: Remove wallpaper.jpg from GResources, return None from resolve_background_path when no file found, skip background picture creation when no texture available.
|
||||
|
||||
## 2026-03-28 – Audit-driven security and lifecycle fixes (v0.6.0)
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Triple audit (quality, performance, security) revealed a critical D-Bus signal spoofing vector, fingerprint lifecycle bugs, and multi-monitor performance issues.
|
||||
- **Tradeoffs**: `cleanup_dbus()` extraction adds a method but clarifies the stop/match ownership; `running_flag: Rc<Cell<bool>>` adds a field but prevents race between async restart and stop; sender validation adds a check per signal but closes the only known auth bypass.
|
||||
- **How**: (1) Validate D-Bus VerifyStatus sender against fprintd's unique bus name. (2) Extract `cleanup_dbus()` from `stop()`, call it on verify-match. (3) `Rc<Cell<bool>>` running flag checked after await in `restart_verify_async`. (4) Consistent 3s D-Bus timeouts. (5) Panic hook before logging. (6) Blur and avatar caches shared across monitors. (7) Peek icon disabled. (8) Symlink rejection for background_path. (9) TOML parse errors logged.
|
||||
|
||||
## 2026-03-28 – GPU blur via GskBlurNode replaces CPU blur
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: CPU-side Gaussian blur (`image` crate) blocked the GTK main thread for 500ms–2s on 4K wallpapers at cold cache. Disk cache mitigated repeat starts but added ~100 lines of complexity.
|
||||
- **Tradeoffs**: GPU blur quality is slightly different (box-blur approximation vs true Gaussian), acceptable for wallpaper. Removes `image` and `dirs` dependencies entirely. No disk cache needed.
|
||||
- **How**: `Snapshot::push_blur()` + `GskRenderer::render_texture()` on `connect_realize`. Blur happens once on the GPU when the widget gets its renderer, producing a concrete `gdk::Texture`. Zero startup latency.
|
||||
|
||||
## 2026-03-28 – Optional background blur via `image` crate (superseded)
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Consistent with moonset/moongreet — blurred wallpaper as lockscreen background is a common UX pattern
|
||||
- **Tradeoffs**: Adds `image` crate dependency (~15 transitive crates); CPU-side Gaussian blur at load time adds startup latency proportional to image size and sigma. Acceptable because blur runs once and the texture is shared across monitors.
|
||||
- **How**: `load_background_texture(bg_path, blur_radius)` loads texture, optionally applies `imageops::blur()`, returns `gdk::Texture`. Config option `background_blur: Option<f32>` in TOML.
|
||||
|
||||
## 2026-03-28 – Shared wallpaper texture pattern (aligned with moonset/moongreet)
|
||||
|
||||
- **Who**: ClaudeCode, Dom
|
||||
- **Why**: Previously loaded wallpaper per-window via `Picture::for_filename()`. Multi-monitor setups decoded the JPEG redundantly. Blur feature requires texture pixel access anyway.
|
||||
- **Tradeoffs**: Slightly more code in main.rs (texture loaded before window creation), but avoids redundant decoding and enables the blur feature.
|
||||
- **How**: `load_background_texture()` in lockscreen.rs decodes once, `create_background_picture()` wraps shared `gdk::Texture` in `gtk::Picture`. Same pattern as moonset/moongreet.
|
||||
17
README.md
17
README.md
@ -5,16 +5,14 @@ Part of the Moonarch ecosystem.
|
||||
|
||||
## Features
|
||||
|
||||
- **ext-session-lock-v1** — Protocol-guaranteed screen locking (compositor keeps screen locked on crash, `exit(1)` in release if unsupported)
|
||||
- **PAM authentication** — Uses system PAM stack (`/etc/pam.d/moonlock`) with 30s timeout and generation counter
|
||||
- **Fingerprint unlock** — fprintd D-Bus integration with sender validation, async init (window appears instantly), `pam_acct_mgmt` check after verify, auto-resume on transient errors
|
||||
- **Multi-monitor + hotplug** — Lockscreen on every monitor with shared blur and avatar caches; monitors added after suspend/resume get windows automatically via `connect_monitor` signal
|
||||
- **GPU blur** — Background blur via GskBlurNode (downscale to max 1920px, configurable 0–200)
|
||||
- **ext-session-lock-v1** — Protocol-guaranteed screen locking (compositor keeps screen locked on crash)
|
||||
- **PAM authentication** — Uses system PAM stack (`/etc/pam.d/moonlock`)
|
||||
- **Fingerprint unlock** — fprintd D-Bus integration (optional)
|
||||
- **Multi-monitor** — Lockscreen on every monitor
|
||||
- **i18n** — German and English (auto-detected)
|
||||
- **Faillock warning** — Progressive UI warning after failed attempts, PAM decides lockout
|
||||
- **Panic safety** — Panic hook logs but never unlocks (installed before logging)
|
||||
- **Password wiping** — `Zeroize` on drop from GTK entry through PAM FFI layer
|
||||
- **Journal logging** — `journalctl -t moonlock`, debug level via `MOONLOCK_DEBUG` env var
|
||||
- **Faillock warning** — UI counter + system pam_faillock
|
||||
- **Panic safety** — Panic hook logs but never unlocks
|
||||
- **Password wiping** — Zeroize on drop
|
||||
|
||||
## Requirements
|
||||
|
||||
@ -48,7 +46,6 @@ Create `/etc/moonlock/moonlock.toml` or `~/.config/moonlock/moonlock.toml`:
|
||||
|
||||
```toml
|
||||
background_path = "/usr/share/wallpapers/moon.jpg"
|
||||
background_blur = 40.0 # 0.0–200.0, optional
|
||||
fingerprint_enabled = true
|
||||
```
|
||||
|
||||
|
||||
2
build.rs
2
build.rs
@ -1,5 +1,5 @@
|
||||
// ABOUTME: Build script for compiling GResource bundle.
|
||||
// ABOUTME: Bundles style.css and default-avatar.svg into the binary.
|
||||
// ABOUTME: Bundles style.css, wallpaper.jpg, and default-avatar.svg into the binary.
|
||||
|
||||
fn main() {
|
||||
glib_build_tools::compile_resources(
|
||||
|
||||
@ -4,7 +4,7 @@
|
||||
# Maintainer: Dominik Kressler
|
||||
|
||||
pkgname=moonlock-git
|
||||
pkgver=0.4.1.r1.g78bcf90
|
||||
pkgver=0.4.0.r0.g0000000
|
||||
pkgrel=1
|
||||
pkgdesc="A secure Wayland lockscreen with GTK4, PAM and fingerprint support"
|
||||
arch=('x86_64')
|
||||
@ -15,7 +15,6 @@ depends=(
|
||||
'gtk4-layer-shell'
|
||||
'gtk-session-lock'
|
||||
'pam'
|
||||
'systemd-libs'
|
||||
)
|
||||
makedepends=(
|
||||
'git'
|
||||
|
||||
@ -1,7 +1,8 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<gresources>
|
||||
<gresource prefix="/dev/moonarch/moonlock">
|
||||
<file compressed="true">style.css</file>
|
||||
<file compressed="true">default-avatar.svg</file>
|
||||
<file>style.css</file>
|
||||
<file>wallpaper.jpg</file>
|
||||
<file>default-avatar.svg</file>
|
||||
</gresource>
|
||||
</gresources>
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
/* ABOUTME: GTK4 CSS stylesheet for the Moonlock lockscreen. */
|
||||
/* ABOUTME: Uses GTK theme colors for consistency with the active desktop theme. */
|
||||
/* ABOUTME: Dark theme styling matching the Moonarch ecosystem. */
|
||||
|
||||
/* Main window background */
|
||||
window.lockscreen {
|
||||
background-color: @theme_bg_color;
|
||||
background-color: #1a1a2e;
|
||||
background-size: cover;
|
||||
background-position: center;
|
||||
opacity: 0;
|
||||
@ -23,18 +23,18 @@ window.lockscreen.visible {
|
||||
|
||||
/* Round avatar image */
|
||||
.avatar {
|
||||
border-radius: 9999px;
|
||||
border-radius: 50%;
|
||||
min-width: 128px;
|
||||
min-height: 128px;
|
||||
background-color: @theme_selected_bg_color;
|
||||
border: 3px solid alpha(@theme_fg_color, 0.3);
|
||||
border: 3px solid alpha(white, 0.3);
|
||||
}
|
||||
|
||||
/* Username label */
|
||||
.username-label {
|
||||
font-size: 24px;
|
||||
font-weight: bold;
|
||||
color: @theme_fg_color;
|
||||
color: white;
|
||||
margin-top: 12px;
|
||||
margin-bottom: 40px;
|
||||
}
|
||||
@ -46,29 +46,29 @@ window.lockscreen.visible {
|
||||
|
||||
/* Error message label */
|
||||
.error-label {
|
||||
color: @error_color;
|
||||
color: #ff6b6b;
|
||||
font-size: 14px;
|
||||
}
|
||||
|
||||
/* Fingerprint status indicator */
|
||||
.fingerprint-label {
|
||||
color: alpha(@theme_fg_color, 0.6);
|
||||
color: alpha(white, 0.6);
|
||||
font-size: 13px;
|
||||
margin-top: 8px;
|
||||
}
|
||||
|
||||
.fingerprint-label.success {
|
||||
color: @success_color;
|
||||
color: #51cf66;
|
||||
}
|
||||
|
||||
.fingerprint-label.failed {
|
||||
color: @error_color;
|
||||
color: #ff6b6b;
|
||||
}
|
||||
|
||||
/* Confirmation prompt */
|
||||
.confirm-label {
|
||||
font-size: 16px;
|
||||
color: @theme_fg_color;
|
||||
color: white;
|
||||
margin-bottom: 4px;
|
||||
}
|
||||
|
||||
@ -103,12 +103,12 @@ window.lockscreen.visible {
|
||||
min-height: 48px;
|
||||
padding: 0px;
|
||||
border-radius: 24px;
|
||||
background-color: alpha(@theme_fg_color, 0.1);
|
||||
color: @theme_fg_color;
|
||||
background-color: alpha(white, 0.1);
|
||||
color: white;
|
||||
border: none;
|
||||
margin: 4px;
|
||||
}
|
||||
|
||||
.power-button:hover {
|
||||
background-color: alpha(@theme_fg_color, 0.25);
|
||||
background-color: alpha(white, 0.25);
|
||||
}
|
||||
|
||||
BIN
resources/wallpaper.jpg
Normal file
BIN
resources/wallpaper.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 366 KiB |
87
src/auth.rs
87
src/auth.rs
@ -8,7 +8,6 @@ use zeroize::Zeroizing;
|
||||
// PAM return codes
|
||||
const PAM_SUCCESS: i32 = 0;
|
||||
const PAM_BUF_ERR: i32 = 5;
|
||||
const PAM_AUTH_ERR: i32 = 7;
|
||||
|
||||
// PAM message styles
|
||||
const PAM_PROMPT_ECHO_OFF: libc::c_int = 1;
|
||||
@ -71,14 +70,10 @@ unsafe extern "C" fn pam_conv_callback(
|
||||
appdata_ptr: *mut libc::c_void,
|
||||
) -> libc::c_int {
|
||||
unsafe {
|
||||
if num_msg <= 0 {
|
||||
return PAM_AUTH_ERR;
|
||||
}
|
||||
|
||||
// Safety: appdata_ptr was set to a valid *const CString in authenticate()
|
||||
let password = appdata_ptr as *const CString;
|
||||
if password.is_null() {
|
||||
return PAM_AUTH_ERR;
|
||||
return 7; // PAM_AUTH_ERR
|
||||
}
|
||||
|
||||
// Safety: calloc returns zeroed memory for num_msg PamResponse structs.
|
||||
@ -89,7 +84,7 @@ unsafe extern "C" fn pam_conv_callback(
|
||||
) as *mut PamResponse;
|
||||
|
||||
if resp_array.is_null() {
|
||||
return PAM_BUF_ERR;
|
||||
return 7; // PAM_AUTH_ERR
|
||||
}
|
||||
|
||||
for i in 0..num_msg as isize {
|
||||
@ -149,9 +144,10 @@ unsafe extern "C" fn pam_conv_callback(
|
||||
/// Returns true on success, false on authentication failure.
|
||||
/// The password is wiped from memory after use via zeroize.
|
||||
pub fn authenticate(username: &str, password: &str) -> bool {
|
||||
// CString::new takes ownership of the Vec — Zeroizing<CString> wipes on drop
|
||||
let password_cstr = match CString::new(password.as_bytes().to_vec()) {
|
||||
Ok(c) => Zeroizing::new(c),
|
||||
// Use Zeroizing to ensure password bytes are wiped on drop
|
||||
let password_bytes = Zeroizing::new(password.as_bytes().to_vec());
|
||||
let password_cstr = match CString::new(password_bytes.as_slice()) {
|
||||
Ok(c) => c,
|
||||
Err(_) => return false, // Password contains null byte
|
||||
};
|
||||
|
||||
@ -167,7 +163,7 @@ pub fn authenticate(username: &str, password: &str) -> bool {
|
||||
|
||||
let conv = PamConv {
|
||||
conv: pam_conv_callback,
|
||||
appdata_ptr: std::ptr::from_ref::<CString>(&password_cstr) as *mut libc::c_void,
|
||||
appdata_ptr: &password_cstr as *const CString as *mut libc::c_void,
|
||||
};
|
||||
|
||||
let mut handle: *mut libc::c_void = ptr::null_mut();
|
||||
@ -191,12 +187,7 @@ pub fn authenticate(username: &str, password: &str) -> bool {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Safety: handle is valid and non-null after successful pam_start.
|
||||
// Note: pam_setcred is intentionally NOT called here. A lockscreen unlocks
|
||||
// an existing session whose credentials were already established at login;
|
||||
// refreshing them would duplicate work done by the session's login manager.
|
||||
// If per-unlock credential refresh (Kerberos tickets, pam_gnome_keyring)
|
||||
// is ever desired, hook it here with PAM_ESTABLISH_CRED.
|
||||
// Safety: handle is valid and non-null after successful pam_start
|
||||
let auth_ret = unsafe { pam_authenticate(handle, 0) };
|
||||
let acct_ret = if auth_ret == PAM_SUCCESS {
|
||||
// Safety: handle is valid, check account restrictions
|
||||
@ -211,56 +202,6 @@ pub fn authenticate(username: &str, password: &str) -> bool {
|
||||
acct_ret == PAM_SUCCESS
|
||||
}
|
||||
|
||||
/// Check account restrictions via PAM without authentication.
|
||||
///
|
||||
/// Used after fingerprint unlock to enforce account policies (lockout, expiry)
|
||||
/// that would otherwise be bypassed when not going through pam_authenticate.
|
||||
/// Returns true if the account is valid and allowed to log in.
|
||||
///
|
||||
/// **Precondition**: `username` must be the authenticated system user, derived
|
||||
/// via `users::get_current_user()` (which reads `getuid()`). Calling this with
|
||||
/// an attacker-controlled username is unsafe — `pam_acct_mgmt` returns SUCCESS
|
||||
/// for any valid unlocked account, giving a trivial unlock bypass.
|
||||
pub(crate) fn check_account(username: &str) -> bool {
|
||||
let service = match CString::new("moonlock") {
|
||||
Ok(c) => c,
|
||||
Err(_) => return false,
|
||||
};
|
||||
|
||||
let username_cstr = match CString::new(username) {
|
||||
Ok(c) => c,
|
||||
Err(_) => return false,
|
||||
};
|
||||
|
||||
// No password needed — we only check account status, not authenticate.
|
||||
// PAM conv callback is required by pam_start but won't be called for acct_mgmt.
|
||||
let empty_password = Zeroizing::new(CString::new("").unwrap());
|
||||
let conv = PamConv {
|
||||
conv: pam_conv_callback,
|
||||
appdata_ptr: std::ptr::from_ref::<CString>(&empty_password) as *mut libc::c_void,
|
||||
};
|
||||
|
||||
let mut handle: *mut libc::c_void = ptr::null_mut();
|
||||
|
||||
let ret = unsafe {
|
||||
pam_start(
|
||||
service.as_ptr(),
|
||||
username_cstr.as_ptr(),
|
||||
&conv,
|
||||
&mut handle,
|
||||
)
|
||||
};
|
||||
|
||||
if ret != PAM_SUCCESS || handle.is_null() {
|
||||
return false;
|
||||
}
|
||||
|
||||
let acct_ret = unsafe { pam_acct_mgmt(handle, 0) };
|
||||
unsafe { pam_end(handle, acct_ret) };
|
||||
|
||||
acct_ret == PAM_SUCCESS
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
@ -295,16 +236,4 @@ mod tests {
|
||||
let result = authenticate("", "password");
|
||||
assert!(!result);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn check_account_empty_username_fails() {
|
||||
let result = check_account("");
|
||||
assert!(!result);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn check_account_null_byte_username_fails() {
|
||||
let result = check_account("user\0name");
|
||||
assert!(!result);
|
||||
}
|
||||
}
|
||||
|
||||
@ -6,6 +6,7 @@ use std::fs;
|
||||
use std::path::{Path, PathBuf};
|
||||
|
||||
const MOONARCH_WALLPAPER: &str = "/usr/share/moonarch/wallpaper.jpg";
|
||||
const GRESOURCE_PREFIX: &str = "/dev/moonarch/moonlock";
|
||||
|
||||
fn default_config_paths() -> Vec<PathBuf> {
|
||||
let mut paths = vec![PathBuf::from("/etc/moonlock/moonlock.toml")];
|
||||
@ -20,7 +21,6 @@ fn default_config_paths() -> Vec<PathBuf> {
|
||||
#[derive(Debug, Clone, Default, Deserialize)]
|
||||
struct RawConfig {
|
||||
pub background_path: Option<String>,
|
||||
pub background_blur: Option<f32>,
|
||||
pub fingerprint_enabled: Option<bool>,
|
||||
}
|
||||
|
||||
@ -28,7 +28,6 @@ struct RawConfig {
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct Config {
|
||||
pub background_path: Option<String>,
|
||||
pub background_blur: Option<f32>,
|
||||
pub fingerprint_enabled: bool,
|
||||
}
|
||||
|
||||
@ -36,7 +35,6 @@ impl Default for Config {
|
||||
fn default() -> Self {
|
||||
Config {
|
||||
background_path: None,
|
||||
background_blur: None,
|
||||
fingerprint_enabled: true,
|
||||
}
|
||||
}
|
||||
@ -48,43 +46,33 @@ pub fn load_config(config_paths: Option<&[PathBuf]>) -> Config {
|
||||
let mut merged = Config::default();
|
||||
for path in paths {
|
||||
if let Ok(content) = fs::read_to_string(path) {
|
||||
match toml::from_str::<RawConfig>(&content) {
|
||||
Ok(parsed) => {
|
||||
if let Ok(parsed) = toml::from_str::<RawConfig>(&content) {
|
||||
if parsed.background_path.is_some() { merged.background_path = parsed.background_path; }
|
||||
if let Some(blur) = parsed.background_blur {
|
||||
merged.background_blur = Some(blur.clamp(0.0, 200.0));
|
||||
}
|
||||
if let Some(fp) = parsed.fingerprint_enabled { merged.fingerprint_enabled = fp; }
|
||||
}
|
||||
Err(e) => {
|
||||
log::warn!("Failed to parse {}: {e}", path.display());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
merged
|
||||
}
|
||||
|
||||
pub fn resolve_background_path(config: &Config) -> Option<PathBuf> {
|
||||
pub fn resolve_background_path(config: &Config) -> PathBuf {
|
||||
resolve_background_path_with(config, Path::new(MOONARCH_WALLPAPER))
|
||||
}
|
||||
|
||||
pub fn resolve_background_path_with(config: &Config, moonarch_wallpaper: &Path) -> Option<PathBuf> {
|
||||
pub fn resolve_background_path_with(config: &Config, moonarch_wallpaper: &Path) -> PathBuf {
|
||||
if let Some(ref bg) = config.background_path {
|
||||
let path = PathBuf::from(bg);
|
||||
if let Ok(meta) = path.symlink_metadata() {
|
||||
if meta.is_file() && !meta.file_type().is_symlink() { return Some(path); }
|
||||
if path.is_file() { return path; }
|
||||
}
|
||||
}
|
||||
if moonarch_wallpaper.is_file() { return Some(moonarch_wallpaper.to_path_buf()); }
|
||||
None
|
||||
if moonarch_wallpaper.is_file() { return moonarch_wallpaper.to_path_buf(); }
|
||||
PathBuf::from(format!("{GRESOURCE_PREFIX}/wallpaper.jpg"))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test] fn default_config() { let c = Config::default(); assert!(c.background_path.is_none()); assert!(c.background_blur.is_none()); assert!(c.fingerprint_enabled); }
|
||||
#[test] fn default_config() { let c = Config::default(); assert!(c.background_path.is_none()); assert!(c.fingerprint_enabled); }
|
||||
#[test] fn load_default_fingerprint_true() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let conf = dir.path().join("moonlock.toml");
|
||||
@ -95,24 +83,16 @@ mod tests {
|
||||
#[test] fn load_background() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let conf = dir.path().join("moonlock.toml");
|
||||
fs::write(&conf, "background_path = \"/custom/bg.jpg\"\nbackground_blur = 15.0\nfingerprint_enabled = false\n").unwrap();
|
||||
fs::write(&conf, "background_path = \"/custom/bg.jpg\"\nfingerprint_enabled = false\n").unwrap();
|
||||
let c = load_config(Some(&[conf]));
|
||||
assert_eq!(c.background_path.as_deref(), Some("/custom/bg.jpg"));
|
||||
assert_eq!(c.background_blur, Some(15.0));
|
||||
assert!(!c.fingerprint_enabled);
|
||||
}
|
||||
#[test] fn load_blur_optional() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let conf = dir.path().join("moonlock.toml");
|
||||
fs::write(&conf, "background_path = \"/bg.jpg\"\n").unwrap();
|
||||
let c = load_config(Some(&[conf]));
|
||||
assert!(c.background_blur.is_none());
|
||||
}
|
||||
#[test] fn resolve_config_path() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let wp = dir.path().join("bg.jpg"); fs::write(&wp, "fake").unwrap();
|
||||
let c = Config { background_path: Some(wp.to_str().unwrap().to_string()), ..Config::default() };
|
||||
assert_eq!(resolve_background_path_with(&c, Path::new("/nonexistent")), Some(wp));
|
||||
let c = Config { background_path: Some(wp.to_str().unwrap().to_string()), fingerprint_enabled: true };
|
||||
assert_eq!(resolve_background_path_with(&c, Path::new("/nonexistent")), wp);
|
||||
}
|
||||
#[test] fn empty_user_config_preserves_system_fingerprint() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
@ -123,29 +103,9 @@ mod tests {
|
||||
let c = load_config(Some(&[sys_conf, usr_conf]));
|
||||
assert!(!c.fingerprint_enabled);
|
||||
}
|
||||
#[test] fn resolve_no_wallpaper_returns_none() {
|
||||
#[test] fn resolve_gresource_fallback() {
|
||||
let c = Config::default();
|
||||
let r = resolve_background_path_with(&c, Path::new("/nonexistent"));
|
||||
assert!(r.is_none());
|
||||
}
|
||||
#[test] fn toml_parse_error_returns_default() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let conf = dir.path().join("moonlock.toml");
|
||||
fs::write(&conf, "this is not valid toml {{{{").unwrap();
|
||||
let c = load_config(Some(&[conf]));
|
||||
assert!(c.fingerprint_enabled);
|
||||
assert!(c.background_path.is_none());
|
||||
}
|
||||
#[cfg(unix)]
|
||||
#[test] fn symlink_rejected_for_background() {
|
||||
let dir = tempfile::tempdir().unwrap();
|
||||
let real = dir.path().join("bg.jpg");
|
||||
let link = dir.path().join("link.jpg");
|
||||
fs::write(&real, "fake").unwrap();
|
||||
std::os::unix::fs::symlink(&real, &link).unwrap();
|
||||
let c = Config { background_path: Some(link.to_str().unwrap().to_string()), ..Config::default() };
|
||||
// Symlink should be rejected — falls through to None
|
||||
let r = resolve_background_path_with(&c, Path::new("/nonexistent"));
|
||||
assert!(r.is_none());
|
||||
assert!(r.to_str().unwrap().contains("moonlock"));
|
||||
}
|
||||
}
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
|
||||
use gio::prelude::*;
|
||||
use gtk4::gio;
|
||||
use std::cell::{Cell, RefCell};
|
||||
use std::cell::RefCell;
|
||||
use std::rc::Rc;
|
||||
|
||||
const FPRINTD_BUS_NAME: &str = "net.reactivated.Fprint";
|
||||
@ -12,8 +12,6 @@ const FPRINTD_MANAGER_IFACE: &str = "net.reactivated.Fprint.Manager";
|
||||
const FPRINTD_DEVICE_IFACE: &str = "net.reactivated.Fprint.Device";
|
||||
|
||||
const MAX_FP_ATTEMPTS: u32 = 10;
|
||||
const DBUS_TIMEOUT_MS: i32 = 3000;
|
||||
const FPRINTD_DEVICE_PREFIX: &str = "/net/reactivated/Fprint/Device/";
|
||||
|
||||
/// Retry-able statuses — finger not read properly, try again.
|
||||
const RETRY_STATUSES: &[&str] = &[
|
||||
@ -28,48 +26,38 @@ pub struct FingerprintListener {
|
||||
device_proxy: Option<gio::DBusProxy>,
|
||||
signal_id: Option<glib::SignalHandlerId>,
|
||||
running: bool,
|
||||
/// Shared flag for async tasks to detect stop() between awaits.
|
||||
running_flag: Rc<Cell<bool>>,
|
||||
failed_attempts: u32,
|
||||
on_success: Option<Box<dyn Fn() + 'static>>,
|
||||
on_failure: Option<Box<dyn Fn() + 'static>>,
|
||||
on_exhausted: Option<Box<dyn Fn() + 'static>>,
|
||||
}
|
||||
|
||||
impl Default for FingerprintListener {
|
||||
fn default() -> Self {
|
||||
FingerprintListener {
|
||||
device_proxy: None,
|
||||
signal_id: None,
|
||||
running: false,
|
||||
running_flag: Rc::new(Cell::new(false)),
|
||||
failed_attempts: 0,
|
||||
on_success: None,
|
||||
on_failure: None,
|
||||
on_exhausted: None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl FingerprintListener {
|
||||
/// Create a lightweight FingerprintListener without any D-Bus calls.
|
||||
/// Call `init_async().await` afterwards to connect to fprintd.
|
||||
/// Create a new FingerprintListener.
|
||||
/// Connects to fprintd synchronously — call before creating GTK windows.
|
||||
pub fn new() -> Self {
|
||||
Self::default()
|
||||
let mut listener = FingerprintListener {
|
||||
device_proxy: None,
|
||||
signal_id: None,
|
||||
running: false,
|
||||
failed_attempts: 0,
|
||||
on_success: None,
|
||||
on_failure: None,
|
||||
};
|
||||
listener.init_device();
|
||||
listener
|
||||
}
|
||||
|
||||
/// Connect to fprintd and get the default device asynchronously.
|
||||
pub async fn init_async(&mut self) {
|
||||
let manager = match gio::DBusProxy::for_bus_future(
|
||||
/// Connect to fprintd and get the default device.
|
||||
fn init_device(&mut self) {
|
||||
let manager = match gio::DBusProxy::for_bus_sync(
|
||||
gio::BusType::System,
|
||||
gio::DBusProxyFlags::NONE,
|
||||
None,
|
||||
FPRINTD_BUS_NAME,
|
||||
FPRINTD_MANAGER_PATH,
|
||||
FPRINTD_MANAGER_IFACE,
|
||||
)
|
||||
.await
|
||||
{
|
||||
gio::Cancellable::NONE,
|
||||
) {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
log::debug!("fprintd manager not available: {e}");
|
||||
@ -78,10 +66,13 @@ impl FingerprintListener {
|
||||
};
|
||||
|
||||
// Call GetDefaultDevice
|
||||
let result = match manager
|
||||
.call_future("GetDefaultDevice", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
|
||||
.await
|
||||
{
|
||||
let result = match manager.call_sync(
|
||||
"GetDefaultDevice",
|
||||
None,
|
||||
gio::DBusCallFlags::NONE,
|
||||
-1,
|
||||
gio::Cancellable::NONE,
|
||||
) {
|
||||
Ok(r) => r,
|
||||
Err(e) => {
|
||||
log::debug!("fprintd GetDefaultDevice failed: {e}");
|
||||
@ -90,31 +81,20 @@ impl FingerprintListener {
|
||||
};
|
||||
|
||||
// Extract device path from variant tuple
|
||||
let device_path = match result.child_value(0).get::<String>() {
|
||||
Some(p) => p,
|
||||
None => {
|
||||
log::debug!("fprintd: unexpected GetDefaultDevice response type");
|
||||
return;
|
||||
}
|
||||
};
|
||||
let device_path: String = result.child_get::<String>(0);
|
||||
if device_path.is_empty() {
|
||||
return;
|
||||
}
|
||||
if !device_path.starts_with(FPRINTD_DEVICE_PREFIX) {
|
||||
log::warn!("Unexpected fprintd device path: {device_path}");
|
||||
return;
|
||||
}
|
||||
|
||||
match gio::DBusProxy::for_bus_future(
|
||||
match gio::DBusProxy::for_bus_sync(
|
||||
gio::BusType::System,
|
||||
gio::DBusProxyFlags::NONE,
|
||||
None,
|
||||
FPRINTD_BUS_NAME,
|
||||
&device_path,
|
||||
FPRINTD_DEVICE_IFACE,
|
||||
)
|
||||
.await
|
||||
{
|
||||
gio::Cancellable::NONE,
|
||||
) {
|
||||
Ok(proxy) => {
|
||||
self.device_proxy = Some(proxy);
|
||||
}
|
||||
@ -124,140 +104,93 @@ impl FingerprintListener {
|
||||
}
|
||||
}
|
||||
|
||||
/// Check if fprintd is available and the user has enrolled fingerprints (async).
|
||||
pub async fn is_available_async(&self, username: &str) -> bool {
|
||||
/// Check if fprintd is available and the user has enrolled fingerprints.
|
||||
pub fn is_available(&self, username: &str) -> bool {
|
||||
let proxy = match &self.device_proxy {
|
||||
Some(p) => p,
|
||||
None => return false,
|
||||
};
|
||||
|
||||
let args = glib::Variant::from((&username,));
|
||||
match proxy
|
||||
.call_future("ListEnrolledFingers", Some(&args), gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
|
||||
.await
|
||||
{
|
||||
match proxy.call_sync(
|
||||
"ListEnrolledFingers",
|
||||
Some(&args),
|
||||
gio::DBusCallFlags::NONE,
|
||||
-1,
|
||||
gio::Cancellable::NONE,
|
||||
) {
|
||||
Ok(result) => {
|
||||
// Result is a tuple of (array of strings)
|
||||
match result.child_value(0).get::<Vec<String>>() {
|
||||
Some(fingers) => !fingers.is_empty(),
|
||||
None => {
|
||||
log::debug!("fprintd: unexpected ListEnrolledFingers response type");
|
||||
false
|
||||
}
|
||||
}
|
||||
let fingers: Vec<String> = result.child_get::<Vec<String>>(0);
|
||||
!fingers.is_empty()
|
||||
}
|
||||
Err(_) => false,
|
||||
}
|
||||
}
|
||||
|
||||
/// Start listening for fingerprint verification.
|
||||
/// Claims the device and starts verification using async D-Bus calls.
|
||||
/// Connects the D-Bus g-signal handler internally. The `listener` parameter
|
||||
/// must be the same `Rc<RefCell<FingerprintListener>>` that owns `self`.
|
||||
pub async fn start_async<F, G, H>(
|
||||
pub fn start<F, G>(
|
||||
listener: &Rc<RefCell<FingerprintListener>>,
|
||||
username: &str,
|
||||
on_success: F,
|
||||
on_failure: G,
|
||||
on_exhausted: H,
|
||||
) where
|
||||
F: Fn() + 'static,
|
||||
G: Fn() + 'static,
|
||||
H: Fn() + 'static,
|
||||
{
|
||||
let proxy = {
|
||||
let inner = listener.borrow();
|
||||
match inner.device_proxy.clone() {
|
||||
Some(p) => p,
|
||||
None => return,
|
||||
}
|
||||
};
|
||||
|
||||
{
|
||||
let mut inner = listener.borrow_mut();
|
||||
inner.on_success = Some(Box::new(on_success));
|
||||
inner.on_failure = Some(Box::new(on_failure));
|
||||
inner.on_exhausted = Some(Box::new(on_exhausted));
|
||||
}
|
||||
|
||||
Self::begin_verification(listener, username).await;
|
||||
}
|
||||
|
||||
/// Resume fingerprint verification after a transient interruption (e.g. failed
|
||||
/// PAM account check). Reuses previously stored callbacks. Re-claims the device
|
||||
/// and restarts verification from scratch. Awaits any in-flight VerifyStop +
|
||||
/// Release before re-claiming the device so fprintd does not reject the Claim
|
||||
/// while the previous session is still being torn down.
|
||||
pub async fn resume_async(
|
||||
listener: &Rc<RefCell<FingerprintListener>>,
|
||||
username: &str,
|
||||
) {
|
||||
// Drain in-flight cleanup so the device is actually released before Claim.
|
||||
// Without this, a fast resume after on_verify_status's fire-and-forget
|
||||
// cleanup races the Release call and fprintd returns "already claimed".
|
||||
let proxy = listener.borrow_mut().take_cleanup_proxy();
|
||||
if let Some(proxy) = proxy {
|
||||
Self::perform_dbus_cleanup(proxy).await;
|
||||
}
|
||||
// Deliberately do NOT reset failed_attempts here. An attacker with sensor
|
||||
// control could otherwise cycle verify-match → check_account fail → resume,
|
||||
// and the 10-attempt cap would never trigger. The counter decays only via
|
||||
// a fresh lock session (listener construction).
|
||||
Self::begin_verification(listener, username).await;
|
||||
}
|
||||
|
||||
/// Claim device, start verification, and connect D-Bus signal handler.
|
||||
/// Assumes device_proxy is set and callbacks are already stored.
|
||||
async fn begin_verification(
|
||||
listener: &Rc<RefCell<FingerprintListener>>,
|
||||
username: &str,
|
||||
) {
|
||||
let proxy = {
|
||||
let mut inner = listener.borrow_mut();
|
||||
let proxy = match inner.device_proxy.clone() {
|
||||
Some(p) => p,
|
||||
None => return,
|
||||
};
|
||||
// Disconnect any previous signal handler to prevent duplicates on resume
|
||||
if let Some(old_id) = inner.signal_id.take() {
|
||||
proxy.disconnect(old_id);
|
||||
}
|
||||
proxy
|
||||
};
|
||||
|
||||
// Claim the device
|
||||
let args = glib::Variant::from((&username,));
|
||||
if let Err(e) = proxy
|
||||
.call_future("Claim", Some(&args), gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
|
||||
.await
|
||||
{
|
||||
if let Err(e) = proxy.call_sync(
|
||||
"Claim",
|
||||
Some(&args),
|
||||
gio::DBusCallFlags::NONE,
|
||||
-1,
|
||||
gio::Cancellable::NONE,
|
||||
) {
|
||||
log::error!("Failed to claim fingerprint device: {e}");
|
||||
return;
|
||||
}
|
||||
|
||||
// Start verification
|
||||
let start_args = glib::Variant::from((&"any",));
|
||||
if let Err(e) = proxy
|
||||
.call_future("VerifyStart", Some(&start_args), gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
|
||||
.await
|
||||
{
|
||||
if let Err(e) = proxy.call_sync(
|
||||
"VerifyStart",
|
||||
Some(&start_args),
|
||||
gio::DBusCallFlags::NONE,
|
||||
-1,
|
||||
gio::Cancellable::NONE,
|
||||
) {
|
||||
log::error!("Failed to start fingerprint verification: {e}");
|
||||
let _ = proxy
|
||||
.call_future("Release", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
|
||||
.await;
|
||||
let _ = proxy.call_sync(
|
||||
"Release",
|
||||
None,
|
||||
gio::DBusCallFlags::NONE,
|
||||
-1,
|
||||
gio::Cancellable::NONE,
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
// Capture the unique bus name of fprintd for sender validation.
|
||||
// D-Bus signals carry the sender's unique name (e.g. ":1.42"), not the
|
||||
// well-known name. We validate this to prevent signal spoofing.
|
||||
let expected_sender = proxy.name_owner();
|
||||
|
||||
// Connect the g-signal handler on the proxy to dispatch VerifyStatus
|
||||
let listener_weak = Rc::downgrade(listener);
|
||||
let signal_id = proxy.connect_local("g-signal", false, move |values| {
|
||||
// g-signal arguments: (proxy, sender_name, signal_name, parameters)
|
||||
let sender: String = match values[1].get() {
|
||||
Ok(s) => s,
|
||||
Err(_) => return None,
|
||||
};
|
||||
if expected_sender.as_ref().map(|s| s.as_str()) != Some(sender.as_str()) {
|
||||
log::warn!("Ignoring D-Bus signal from unexpected sender: {sender}");
|
||||
return None;
|
||||
}
|
||||
|
||||
let signal_name: String = match values[2].get() {
|
||||
Ok(v) => v,
|
||||
Err(_) => return None,
|
||||
@ -290,17 +223,15 @@ impl FingerprintListener {
|
||||
let mut inner = listener.borrow_mut();
|
||||
inner.signal_id = Some(signal_id);
|
||||
inner.running = true;
|
||||
inner.running_flag.set(true);
|
||||
}
|
||||
|
||||
/// Process a VerifyStatus signal from fprintd.
|
||||
pub(crate) fn on_verify_status(&mut self, status: &str, done: bool) {
|
||||
pub fn on_verify_status(&mut self, status: &str, done: bool) {
|
||||
if !self.running {
|
||||
return;
|
||||
}
|
||||
|
||||
if status == "verify-match" {
|
||||
self.cleanup_dbus();
|
||||
if let Some(ref cb) = self.on_success {
|
||||
cb();
|
||||
}
|
||||
@ -309,101 +240,80 @@ impl FingerprintListener {
|
||||
|
||||
if RETRY_STATUSES.contains(&status) {
|
||||
if done {
|
||||
self.restart_verify_async();
|
||||
self.restart_verify();
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if status == "verify-no-match" {
|
||||
self.failed_attempts += 1;
|
||||
if self.failed_attempts >= MAX_FP_ATTEMPTS {
|
||||
log::warn!("Fingerprint max attempts ({MAX_FP_ATTEMPTS}) reached, stopping");
|
||||
if let Some(ref cb) = self.on_exhausted {
|
||||
cb();
|
||||
}
|
||||
self.stop();
|
||||
return;
|
||||
}
|
||||
if let Some(ref cb) = self.on_failure {
|
||||
cb();
|
||||
}
|
||||
if self.failed_attempts >= MAX_FP_ATTEMPTS {
|
||||
log::warn!("Fingerprint max attempts ({MAX_FP_ATTEMPTS}) reached, stopping");
|
||||
self.stop();
|
||||
return;
|
||||
}
|
||||
if done {
|
||||
self.restart_verify_async();
|
||||
self.restart_verify();
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
log::debug!("Unhandled fprintd status: {status}");
|
||||
if done {
|
||||
self.restart_verify_async();
|
||||
}
|
||||
}
|
||||
|
||||
/// Restart fingerprint verification asynchronously after a completed attempt.
|
||||
/// Checks running_flag after VerifyStop to avoid restarting on a released device.
|
||||
fn restart_verify_async(&self) {
|
||||
/// Restart fingerprint verification after a completed attempt.
|
||||
fn restart_verify(&self) {
|
||||
if let Some(ref proxy) = self.device_proxy {
|
||||
let proxy = proxy.clone();
|
||||
let running = self.running_flag.clone();
|
||||
glib::spawn_future_local(async move {
|
||||
// VerifyStop before VerifyStart to avoid D-Bus errors
|
||||
let _ = proxy
|
||||
.call_future("VerifyStop", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
|
||||
.await;
|
||||
if !running.get() {
|
||||
return;
|
||||
}
|
||||
let _ = proxy.call_sync(
|
||||
"VerifyStop",
|
||||
None,
|
||||
gio::DBusCallFlags::NONE,
|
||||
-1,
|
||||
gio::Cancellable::NONE,
|
||||
);
|
||||
let args = glib::Variant::from((&"any",));
|
||||
if let Err(e) = proxy
|
||||
.call_future("VerifyStart", Some(&args), gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
|
||||
.await
|
||||
{
|
||||
if let Err(e) = proxy.call_sync(
|
||||
"VerifyStart",
|
||||
Some(&args),
|
||||
gio::DBusCallFlags::NONE,
|
||||
-1,
|
||||
gio::Cancellable::NONE,
|
||||
) {
|
||||
log::error!("Failed to restart fingerprint verification: {e}");
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
/// Disconnect the signal handler and clear running flags. Returns the proxy
|
||||
/// the caller should use for the async D-Bus cleanup (VerifyStop + Release).
|
||||
///
|
||||
/// Split into a sync part (signal disconnect, flags) and an async part
|
||||
/// (`perform_dbus_cleanup`) so callers can either spawn the async work
|
||||
/// fire-and-forget (via `cleanup_dbus`) or await it to serialize with a
|
||||
/// subsequent Claim (via `resume_async`).
|
||||
fn take_cleanup_proxy(&mut self) -> Option<gio::DBusProxy> {
|
||||
self.running = false;
|
||||
self.running_flag.set(false);
|
||||
|
||||
let proxy = self.device_proxy.clone()?;
|
||||
if let Some(id) = self.signal_id.take() {
|
||||
proxy.disconnect(id);
|
||||
}
|
||||
Some(proxy)
|
||||
}
|
||||
|
||||
async fn perform_dbus_cleanup(proxy: gio::DBusProxy) {
|
||||
let _ = proxy
|
||||
.call_future("VerifyStop", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
|
||||
.await;
|
||||
let _ = proxy
|
||||
.call_future("Release", None, gio::DBusCallFlags::NONE, DBUS_TIMEOUT_MS)
|
||||
.await;
|
||||
}
|
||||
|
||||
/// Fire-and-forget cleanup for code paths that cannot await (e.g. drop, stop).
|
||||
fn cleanup_dbus(&mut self) {
|
||||
if let Some(proxy) = self.take_cleanup_proxy() {
|
||||
glib::spawn_future_local(Self::perform_dbus_cleanup(proxy));
|
||||
}
|
||||
}
|
||||
|
||||
/// Stop listening and release the device. Idempotent — safe to call multiple times.
|
||||
/// Stop listening and release the device.
|
||||
pub fn stop(&mut self) {
|
||||
if !self.running {
|
||||
return;
|
||||
}
|
||||
self.cleanup_dbus();
|
||||
self.running = false;
|
||||
|
||||
if let Some(ref proxy) = self.device_proxy {
|
||||
if let Some(id) = self.signal_id.take() {
|
||||
proxy.disconnect(id);
|
||||
}
|
||||
let _ = proxy.call_sync(
|
||||
"VerifyStop",
|
||||
None,
|
||||
gio::DBusCallFlags::NONE,
|
||||
-1,
|
||||
gio::Cancellable::NONE,
|
||||
);
|
||||
let _ = proxy.call_sync(
|
||||
"Release",
|
||||
None,
|
||||
gio::DBusCallFlags::NONE,
|
||||
-1,
|
||||
gio::Cancellable::NONE,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
@ -424,64 +334,4 @@ mod tests {
|
||||
fn max_attempts_constant() {
|
||||
assert_eq!(MAX_FP_ATTEMPTS, 10);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn verify_match_sets_running_false_and_calls_success() {
|
||||
let called = Rc::new(Cell::new(false));
|
||||
let called_clone = called.clone();
|
||||
let mut listener = FingerprintListener::new();
|
||||
listener.running = true;
|
||||
listener.running_flag.set(true);
|
||||
listener.on_success = Some(Box::new(move || { called_clone.set(true); }));
|
||||
|
||||
listener.on_verify_status("verify-match", false);
|
||||
assert!(called.get());
|
||||
assert!(!listener.running);
|
||||
assert!(!listener.running_flag.get());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn verify_no_match_calls_failure_and_stays_running() {
|
||||
let called = Rc::new(Cell::new(false));
|
||||
let called_clone = called.clone();
|
||||
let mut listener = FingerprintListener::new();
|
||||
listener.running = true;
|
||||
listener.running_flag.set(true);
|
||||
listener.on_failure = Some(Box::new(move || { called_clone.set(true); }));
|
||||
|
||||
listener.on_verify_status("verify-no-match", false);
|
||||
assert!(called.get());
|
||||
assert!(listener.running);
|
||||
assert!(listener.running_flag.get());
|
||||
assert_eq!(listener.failed_attempts, 1);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn max_attempts_stops_listener_and_calls_exhausted() {
|
||||
let exhausted = Rc::new(Cell::new(false));
|
||||
let exhausted_clone = exhausted.clone();
|
||||
let mut listener = FingerprintListener::new();
|
||||
listener.running = true;
|
||||
listener.on_failure = Some(Box::new(|| {}));
|
||||
listener.on_exhausted = Some(Box::new(move || { exhausted_clone.set(true); }));
|
||||
|
||||
for _ in 0..MAX_FP_ATTEMPTS {
|
||||
listener.on_verify_status("verify-no-match", true);
|
||||
}
|
||||
assert!(!listener.running);
|
||||
assert!(exhausted.get());
|
||||
assert_eq!(listener.failed_attempts, MAX_FP_ATTEMPTS);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn not_running_ignores_signals() {
|
||||
let called = Rc::new(Cell::new(false));
|
||||
let called_clone = called.clone();
|
||||
let mut listener = FingerprintListener::new();
|
||||
listener.running = false;
|
||||
listener.on_success = Some(Box::new(move || { called_clone.set(true); }));
|
||||
|
||||
listener.on_verify_status("verify-match", false);
|
||||
assert!(!called.get());
|
||||
}
|
||||
}
|
||||
|
||||
55
src/i18n.rs
55
src/i18n.rs
@ -4,13 +4,9 @@
|
||||
use std::env;
|
||||
use std::fs;
|
||||
use std::path::Path;
|
||||
use std::sync::OnceLock;
|
||||
|
||||
const DEFAULT_LOCALE_CONF: &str = "/etc/locale.conf";
|
||||
|
||||
/// Cached locale prefix — detected once, reused for all subsequent calls.
|
||||
static CACHED_LOCALE: OnceLock<String> = OnceLock::new();
|
||||
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct Strings {
|
||||
pub password_placeholder: &'static str,
|
||||
@ -28,7 +24,6 @@ pub struct Strings {
|
||||
pub confirm_no: &'static str,
|
||||
pub faillock_attempts_remaining: &'static str,
|
||||
pub faillock_locked: &'static str,
|
||||
pub auth_timeout: &'static str,
|
||||
}
|
||||
|
||||
const STRINGS_DE: Strings = Strings {
|
||||
@ -47,7 +42,6 @@ const STRINGS_DE: Strings = Strings {
|
||||
confirm_no: "Abbrechen",
|
||||
faillock_attempts_remaining: "Noch {n} Versuch(e) vor Kontosperrung!",
|
||||
faillock_locked: "Konto ist möglicherweise gesperrt",
|
||||
auth_timeout: "Authentifizierung abgelaufen — bitte erneut versuchen",
|
||||
};
|
||||
|
||||
const STRINGS_EN: Strings = Strings {
|
||||
@ -66,7 +60,6 @@ const STRINGS_EN: Strings = Strings {
|
||||
confirm_no: "Cancel",
|
||||
faillock_attempts_remaining: "{n} attempt(s) remaining before lockout!",
|
||||
faillock_locked: "Account may be locked",
|
||||
auth_timeout: "Authentication timed out — please try again",
|
||||
};
|
||||
|
||||
fn parse_lang_prefix(lang: &str) -> String {
|
||||
@ -93,20 +86,14 @@ pub fn detect_locale() -> String {
|
||||
}
|
||||
|
||||
pub fn load_strings(locale: Option<&str>) -> &'static Strings {
|
||||
let locale = match locale {
|
||||
Some(l) => l,
|
||||
None => CACHED_LOCALE.get_or_init(detect_locale),
|
||||
};
|
||||
match locale { "de" => &STRINGS_DE, _ => &STRINGS_EN }
|
||||
let locale = match locale { Some(l) => l.to_string(), None => detect_locale() };
|
||||
match locale.as_str() { "de" => &STRINGS_DE, _ => &STRINGS_EN }
|
||||
}
|
||||
|
||||
/// Returns a warning when the user is close to lockout (2 or fewer attempts remaining).
|
||||
/// Caller is responsible for handling the locked state (count >= max_attempts).
|
||||
pub fn faillock_warning(attempt_count: u32, max_attempts: u32, strings: &Strings) -> Option<String> {
|
||||
let remaining = max_attempts.saturating_sub(attempt_count);
|
||||
if remaining > 0 && remaining <= 2 {
|
||||
return Some(strings.faillock_attempts_remaining.replace("{n}", &remaining.to_string()));
|
||||
}
|
||||
if attempt_count >= max_attempts { return Some(strings.faillock_locked.to_string()); }
|
||||
let remaining = max_attempts - attempt_count;
|
||||
if remaining == 1 { return Some(strings.faillock_attempts_remaining.replace("{n}", &remaining.to_string())); }
|
||||
None
|
||||
}
|
||||
|
||||
@ -140,35 +127,7 @@ mod tests {
|
||||
}
|
||||
|
||||
#[test] fn faillock_zero() { assert!(faillock_warning(0, 3, load_strings(Some("en"))).is_none()); }
|
||||
#[test] fn faillock_one() { assert!(faillock_warning(1, 3, load_strings(Some("en"))).is_some()); }
|
||||
#[test] fn faillock_one() { assert!(faillock_warning(1, 3, load_strings(Some("en"))).is_none()); }
|
||||
#[test] fn faillock_two() { assert!(faillock_warning(2, 3, load_strings(Some("en"))).is_some()); }
|
||||
#[test] fn faillock_three() { assert!(faillock_warning(3, 3, load_strings(Some("en"))).is_none()); }
|
||||
|
||||
#[test]
|
||||
fn faillock_caller_contract() {
|
||||
// Mirrors the lockscreen.rs usage: caller handles count >= max separately,
|
||||
// faillock_warning is only called when count < max.
|
||||
let max = 3u32;
|
||||
let strings = load_strings(Some("en"));
|
||||
for count in 0..max {
|
||||
let result = faillock_warning(count, max, strings);
|
||||
let remaining = max - count;
|
||||
if remaining <= 2 {
|
||||
assert!(result.is_some(), "should warn at count={count} (remaining={remaining})");
|
||||
} else {
|
||||
assert!(result.is_none(), "should not warn at count={count}");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn faillock_warns_progressively_with_higher_max() {
|
||||
let strings = load_strings(Some("en"));
|
||||
// With max=5: warn at count 3 (rem=2) and count 4 (rem=1), not at 0-2
|
||||
assert!(faillock_warning(0, 5, strings).is_none());
|
||||
assert!(faillock_warning(2, 5, strings).is_none());
|
||||
assert!(faillock_warning(3, 5, strings).is_some());
|
||||
assert!(faillock_warning(4, 5, strings).is_some());
|
||||
assert!(faillock_warning(5, 5, strings).is_none()); // at max, caller handles lockout
|
||||
}
|
||||
#[test] fn faillock_three() { assert_eq!(faillock_warning(3, 3, load_strings(Some("en"))).unwrap(), "Account may be locked"); }
|
||||
}
|
||||
|
||||
@ -4,10 +4,9 @@
|
||||
use gdk4 as gdk;
|
||||
use gdk_pixbuf::Pixbuf;
|
||||
use glib::clone;
|
||||
use graphene_rs as graphene;
|
||||
use gtk4::prelude::*;
|
||||
use gtk4::{self as gtk, gio};
|
||||
use std::cell::{Cell, RefCell};
|
||||
use std::cell::RefCell;
|
||||
use std::path::Path;
|
||||
use std::rc::Rc;
|
||||
|
||||
@ -20,38 +19,23 @@ use crate::i18n::{faillock_warning, load_strings, Strings};
|
||||
use crate::power::{self, PowerError};
|
||||
use crate::users;
|
||||
|
||||
/// Handles returned from create_lockscreen_window for post-creation wiring.
|
||||
pub struct LockscreenHandles {
|
||||
pub window: gtk::ApplicationWindow,
|
||||
pub fp_label: gtk::Label,
|
||||
pub password_entry: gtk::PasswordEntry,
|
||||
pub unlock_callback: Rc<dyn Fn()>,
|
||||
pub username: String,
|
||||
state: Rc<RefCell<LockscreenState>>,
|
||||
}
|
||||
|
||||
const AVATAR_SIZE: i32 = 128;
|
||||
const FAILLOCK_MAX_ATTEMPTS: u32 = 3;
|
||||
const PAM_TIMEOUT_SECS: u64 = 30;
|
||||
|
||||
/// Shared mutable state for the lockscreen.
|
||||
struct LockscreenState {
|
||||
failed_attempts: u32,
|
||||
fp_listener: FingerprintListener,
|
||||
fp_listener_rc: Option<Rc<RefCell<FingerprintListener>>>,
|
||||
}
|
||||
|
||||
/// Create a lockscreen window for a single monitor.
|
||||
/// Fingerprint is not initialized here — use `wire_fingerprint()` after async init.
|
||||
/// The `blur_cache` and `avatar_cache` are shared across monitors for multi-monitor
|
||||
/// setups, avoiding redundant GPU renders and SVG rasterizations.
|
||||
pub fn create_lockscreen_window(
|
||||
bg_texture: Option<&gdk::Texture>,
|
||||
bg_path: &Path,
|
||||
config: &Config,
|
||||
app: >k::Application,
|
||||
unlock_callback: Rc<dyn Fn()>,
|
||||
blur_cache: &Rc<RefCell<Option<gdk::Texture>>>,
|
||||
avatar_cache: &Rc<RefCell<Option<gdk::Texture>>>,
|
||||
) -> LockscreenHandles {
|
||||
) -> gtk::ApplicationWindow {
|
||||
let window = gtk::ApplicationWindow::builder()
|
||||
.application(app)
|
||||
.build();
|
||||
@ -62,24 +46,17 @@ pub fn create_lockscreen_window(
|
||||
Some(u) => u,
|
||||
None => {
|
||||
log::error!("Failed to get current user");
|
||||
let fp_label = gtk::Label::new(None);
|
||||
fp_label.set_visible(false);
|
||||
return LockscreenHandles {
|
||||
window,
|
||||
fp_label,
|
||||
password_entry: gtk::PasswordEntry::new(),
|
||||
unlock_callback,
|
||||
username: String::new(),
|
||||
state: Rc::new(RefCell::new(LockscreenState {
|
||||
failed_attempts: 0,
|
||||
fp_listener_rc: None,
|
||||
})),
|
||||
};
|
||||
return window;
|
||||
}
|
||||
};
|
||||
|
||||
let fp_listener = FingerprintListener::new();
|
||||
let fp_available = config.fingerprint_enabled
|
||||
&& fp_listener.is_available(&user.username);
|
||||
|
||||
let state = Rc::new(RefCell::new(LockscreenState {
|
||||
failed_attempts: 0,
|
||||
fp_listener,
|
||||
fp_listener_rc: None,
|
||||
}));
|
||||
|
||||
@ -87,11 +64,9 @@ pub fn create_lockscreen_window(
|
||||
let overlay = gtk::Overlay::new();
|
||||
window.set_child(Some(&overlay));
|
||||
|
||||
// Background wallpaper (if available — otherwise GTK background color shows through)
|
||||
if let Some(texture) = bg_texture {
|
||||
let background = create_background_picture(texture, config.background_blur, blur_cache);
|
||||
// Background wallpaper
|
||||
let background = create_background_picture(bg_path);
|
||||
overlay.set_child(Some(&background));
|
||||
}
|
||||
|
||||
// Centered vertical box
|
||||
let main_box = gtk::Box::new(gtk::Orientation::Vertical, 0);
|
||||
@ -116,17 +91,12 @@ pub fn create_lockscreen_window(
|
||||
avatar_frame.append(&avatar_image);
|
||||
login_box.append(&avatar_frame);
|
||||
|
||||
// Load avatar — use shared cache to avoid redundant loading on multi-monitor setups.
|
||||
// The cache is populated by the first monitor and reused by subsequent ones.
|
||||
if let Some(ref cached) = *avatar_cache.borrow() {
|
||||
avatar_image.set_paintable(Some(cached));
|
||||
} else {
|
||||
// Load avatar
|
||||
let avatar_path = users::get_avatar_path(&user.home, &user.username);
|
||||
if let Some(path) = avatar_path {
|
||||
set_avatar_from_file(&avatar_image, &path, avatar_cache);
|
||||
set_avatar_from_file(&avatar_image, &path);
|
||||
} else {
|
||||
set_default_avatar(&avatar_image, &window, avatar_cache);
|
||||
}
|
||||
set_default_avatar(&avatar_image, &window);
|
||||
}
|
||||
|
||||
// Username label
|
||||
@ -149,10 +119,15 @@ pub fn create_lockscreen_window(
|
||||
error_label.set_visible(false);
|
||||
login_box.append(&error_label);
|
||||
|
||||
// Fingerprint label — hidden until async fprintd init completes
|
||||
// Fingerprint label
|
||||
let fp_label = gtk::Label::new(None);
|
||||
fp_label.add_css_class("fingerprint-label");
|
||||
if fp_available {
|
||||
fp_label.set_text(strings.fingerprint_prompt);
|
||||
fp_label.set_visible(true);
|
||||
} else {
|
||||
fp_label.set_visible(false);
|
||||
}
|
||||
login_box.append(&fp_label);
|
||||
|
||||
// Confirm box area (for power confirm)
|
||||
@ -222,19 +197,13 @@ pub fn create_lockscreen_window(
|
||||
|
||||
overlay.add_overlay(&power_box);
|
||||
|
||||
// Password entry "activate" handler.
|
||||
// A generation counter tracks which auth attempt is current. When the user
|
||||
// submits a new password, the generation increments — stale PAM results from
|
||||
// prior attempts are ignored (except success: a correct password always unlocks).
|
||||
// Password entry "activate" handler
|
||||
let username = user.username.clone();
|
||||
let auth_generation = Rc::new(Cell::new(0u32));
|
||||
password_entry.connect_activate(clone!(
|
||||
#[strong]
|
||||
state,
|
||||
#[strong]
|
||||
unlock_callback,
|
||||
#[strong]
|
||||
auth_generation,
|
||||
#[weak]
|
||||
error_label,
|
||||
#[weak]
|
||||
@ -244,44 +213,11 @@ pub fn create_lockscreen_window(
|
||||
if password.is_empty() {
|
||||
return;
|
||||
}
|
||||
// Clear the GTK entry's internal buffer as early as possible. GTK allocates
|
||||
// the backing GString via libc malloc, which zeroize cannot reach — the
|
||||
// best we can do is shorten the window during which it resides in memory.
|
||||
entry.set_text("");
|
||||
|
||||
entry.set_sensitive(false);
|
||||
let username = username.clone();
|
||||
let unlock_cb = unlock_callback.clone();
|
||||
|
||||
// Invalidate stale timeouts/results from prior attempts
|
||||
let auth_gen = auth_generation.get().wrapping_add(1);
|
||||
auth_generation.set(auth_gen);
|
||||
let gen_timeout = auth_generation.clone();
|
||||
let gen_result = auth_generation.clone();
|
||||
|
||||
// If PAM hangs (e.g. broken LDAP module), the timeout re-enables the UI
|
||||
glib::timeout_add_local_once(
|
||||
std::time::Duration::from_secs(PAM_TIMEOUT_SECS),
|
||||
clone!(
|
||||
#[weak]
|
||||
error_label,
|
||||
#[weak]
|
||||
password_entry,
|
||||
move || {
|
||||
if gen_timeout.get() != auth_gen {
|
||||
return;
|
||||
}
|
||||
log::error!("PAM authentication timed out after {PAM_TIMEOUT_SECS}s");
|
||||
let strings = load_strings(None);
|
||||
password_entry.set_text("");
|
||||
password_entry.set_sensitive(true);
|
||||
password_entry.grab_focus();
|
||||
error_label.set_text(strings.auth_timeout);
|
||||
error_label.set_visible(true);
|
||||
}
|
||||
),
|
||||
);
|
||||
|
||||
glib::spawn_future_local(clone!(
|
||||
#[strong]
|
||||
state,
|
||||
@ -291,24 +227,11 @@ pub fn create_lockscreen_window(
|
||||
password_entry,
|
||||
async move {
|
||||
let user = username.clone();
|
||||
let pass = Zeroizing::new((*password).clone());
|
||||
let result = gio::spawn_blocking(move || {
|
||||
auth::authenticate(&user, &password)
|
||||
auth::authenticate(&user, &pass)
|
||||
}).await;
|
||||
|
||||
// Stale result from a superseded attempt — only unlock on success
|
||||
// (a correct password should always unlock, regardless of timing)
|
||||
if gen_result.get() != auth_gen {
|
||||
if matches!(result, Ok(true)) {
|
||||
let s = state.borrow();
|
||||
if let Some(ref fp_rc) = s.fp_listener_rc {
|
||||
fp_rc.borrow_mut().stop();
|
||||
}
|
||||
drop(s);
|
||||
unlock_cb();
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
match result {
|
||||
Ok(true) => {
|
||||
let s = state.borrow();
|
||||
@ -370,109 +293,19 @@ pub fn create_lockscreen_window(
|
||||
));
|
||||
window.add_controller(key_controller);
|
||||
|
||||
// Fade-in on map
|
||||
window.connect_map(|w| {
|
||||
glib::idle_add_local_once(clone!(
|
||||
#[weak]
|
||||
w,
|
||||
move || {
|
||||
w.add_css_class("visible");
|
||||
}
|
||||
));
|
||||
});
|
||||
// Start fingerprint listener
|
||||
if fp_available {
|
||||
let unlock_cb_fp = unlock_callback.clone();
|
||||
let fp_label_success = fp_label.clone();
|
||||
let fp_label_fail = fp_label.clone();
|
||||
|
||||
// Focus password entry on realize
|
||||
window.connect_realize(clone!(
|
||||
#[weak]
|
||||
password_entry,
|
||||
move |_| {
|
||||
glib::idle_add_local_once(move || {
|
||||
password_entry.grab_focus();
|
||||
});
|
||||
}
|
||||
));
|
||||
|
||||
LockscreenHandles {
|
||||
window,
|
||||
fp_label,
|
||||
password_entry: password_entry.clone(),
|
||||
unlock_callback,
|
||||
username: user.username,
|
||||
state: state.clone(),
|
||||
}
|
||||
}
|
||||
|
||||
/// Show the fingerprint label and store the listener reference for stop-on-unlock.
|
||||
/// Does NOT start verification — call `start_fingerprint()` on one monitor for that.
|
||||
pub fn show_fingerprint_label(
|
||||
handles: &LockscreenHandles,
|
||||
fp_rc: &Rc<RefCell<FingerprintListener>>,
|
||||
) {
|
||||
let strings = load_strings(None);
|
||||
handles.fp_label.set_text(strings.fingerprint_prompt);
|
||||
handles.fp_label.set_visible(true);
|
||||
|
||||
// Store the Rc reference for stop() on unlock
|
||||
handles.state.borrow_mut().fp_listener_rc = Some(fp_rc.clone());
|
||||
}
|
||||
|
||||
/// Start fingerprint verification on a single monitor's handles.
|
||||
/// Wires up on_success/on_failure callbacks and calls start_async.
|
||||
pub fn start_fingerprint(
|
||||
handles: &LockscreenHandles,
|
||||
fp_rc: &Rc<RefCell<FingerprintListener>>,
|
||||
) {
|
||||
let fp_label_success = handles.fp_label.clone();
|
||||
let fp_label_fail = handles.fp_label.clone();
|
||||
let unlock_cb_fp = handles.unlock_callback.clone();
|
||||
|
||||
let fp_rc_success = fp_rc.clone();
|
||||
let fp_username = handles.username.clone();
|
||||
let on_success = move || {
|
||||
let label = fp_label_success.clone();
|
||||
let cb = unlock_cb_fp.clone();
|
||||
let fp = fp_rc_success.clone();
|
||||
let username = fp_username.clone();
|
||||
glib::idle_add_local_once(move || {
|
||||
let strings = load_strings(None);
|
||||
label.set_text(strings.fingerprint_success);
|
||||
label.set_text(load_strings(None).fingerprint_success);
|
||||
label.add_css_class("success");
|
||||
// stop() is idempotent — cleanup_dbus() already ran inside on_verify_status,
|
||||
// but this mirrors the PAM success path for defense-in-depth.
|
||||
fp.borrow_mut().stop();
|
||||
|
||||
// Enforce PAM account policies (lockout, expiry) before unlocking.
|
||||
// Fingerprint auth bypasses pam_authenticate, so we must explicitly
|
||||
// check account restrictions via pam_acct_mgmt.
|
||||
glib::spawn_future_local(async move {
|
||||
let user = username.clone();
|
||||
let result = gio::spawn_blocking(move || {
|
||||
auth::check_account(&user)
|
||||
}).await;
|
||||
match result {
|
||||
Ok(true) => cb(),
|
||||
_ => {
|
||||
log::error!("PAM account check failed after fingerprint auth");
|
||||
let strings = load_strings(None);
|
||||
label.set_text(strings.wrong_password);
|
||||
label.remove_css_class("success");
|
||||
label.add_css_class("failed");
|
||||
// Restart FP verification after delay — the failure may be
|
||||
// transient (e.g. PAM module timeout). If the account is truly
|
||||
// locked, check_account will fail again on next match.
|
||||
glib::timeout_add_local_once(
|
||||
std::time::Duration::from_secs(2),
|
||||
move || {
|
||||
label.set_text(load_strings(None).fingerprint_prompt);
|
||||
label.remove_css_class("failed");
|
||||
glib::spawn_future_local(async move {
|
||||
FingerprintListener::resume_async(&fp, &username).await;
|
||||
});
|
||||
},
|
||||
);
|
||||
}
|
||||
}
|
||||
});
|
||||
cb();
|
||||
});
|
||||
};
|
||||
|
||||
@ -502,198 +335,72 @@ pub fn start_fingerprint(
|
||||
));
|
||||
};
|
||||
|
||||
let fp_label_exhausted = handles.fp_label.clone();
|
||||
let on_exhausted = move || {
|
||||
let label = fp_label_exhausted.clone();
|
||||
// Extract the fp_listener into its own Rc<RefCell<>> for signal self-wiring
|
||||
let fp_rc = {
|
||||
let mut s = state.borrow_mut();
|
||||
let listener = std::mem::replace(&mut s.fp_listener, FingerprintListener::new());
|
||||
Rc::new(RefCell::new(listener))
|
||||
};
|
||||
|
||||
FingerprintListener::start(&fp_rc, &user.username, on_success, on_failure);
|
||||
|
||||
// Store back the Rc reference for stop() on unlock
|
||||
state.borrow_mut().fp_listener_rc = Some(fp_rc);
|
||||
}
|
||||
|
||||
// Fade-in on map
|
||||
window.connect_map(|w| {
|
||||
glib::idle_add_local_once(clone!(
|
||||
#[weak]
|
||||
w,
|
||||
move || {
|
||||
w.add_css_class("visible");
|
||||
}
|
||||
));
|
||||
});
|
||||
|
||||
// Focus password entry on realize
|
||||
window.connect_realize(clone!(
|
||||
#[weak]
|
||||
password_entry,
|
||||
move |_| {
|
||||
glib::idle_add_local_once(move || {
|
||||
label.set_visible(false);
|
||||
password_entry.grab_focus();
|
||||
});
|
||||
};
|
||||
}
|
||||
));
|
||||
|
||||
let username = handles.username.clone();
|
||||
let fp_rc_clone = fp_rc.clone();
|
||||
glib::spawn_future_local(async move {
|
||||
FingerprintListener::start_async(
|
||||
&fp_rc_clone, &username, on_success, on_failure, on_exhausted,
|
||||
).await;
|
||||
});
|
||||
}
|
||||
|
||||
/// Load the wallpaper as a texture once, for sharing across all windows.
|
||||
/// Returns None if no wallpaper path is provided or the file cannot be loaded.
|
||||
/// Blur is applied at render time via GPU (GskBlurNode), not here.
|
||||
///
|
||||
/// Opens the file with O_NOFOLLOW to close the TOCTOU window between the
|
||||
/// symlink check in `resolve_background_path_with` and this read. If the path
|
||||
/// was swapped for a symlink after the check, `open` fails with ELOOP.
|
||||
pub fn load_background_texture(bg_path: &Path) -> Option<gdk::Texture> {
|
||||
use std::io::Read;
|
||||
use std::os::unix::fs::OpenOptionsExt;
|
||||
|
||||
let mut file = match std::fs::OpenOptions::new()
|
||||
.read(true)
|
||||
.custom_flags(libc::O_NOFOLLOW)
|
||||
.open(bg_path)
|
||||
{
|
||||
Ok(f) => f,
|
||||
Err(e) => {
|
||||
log::warn!("Failed to open wallpaper {}: {e}", bg_path.display());
|
||||
return None;
|
||||
}
|
||||
};
|
||||
let mut bytes = Vec::new();
|
||||
if let Err(e) = file.read_to_end(&mut bytes) {
|
||||
log::warn!("Failed to read wallpaper {}: {e}", bg_path.display());
|
||||
return None;
|
||||
}
|
||||
let glib_bytes = glib::Bytes::from_owned(bytes);
|
||||
match gdk::Texture::from_bytes(&glib_bytes) {
|
||||
Ok(texture) => Some(texture),
|
||||
Err(e) => {
|
||||
log::warn!("Failed to decode wallpaper {}: {e}", bg_path.display());
|
||||
None
|
||||
}
|
||||
}
|
||||
window
|
||||
}
|
||||
|
||||
/// Create a Picture widget for the wallpaper background.
|
||||
/// When `blur_radius` is `Some(sigma)` with sigma > 0, blur is applied via GPU
|
||||
/// (GskBlurNode). The blur is rendered to a concrete texture on `realize` (when
|
||||
/// the GPU renderer is available), avoiding lazy-render artifacts.
|
||||
/// The `blur_cache` is shared across monitors — the first to realize renders the
|
||||
/// blur, subsequent monitors reuse the cached texture.
|
||||
fn create_background_picture(
|
||||
texture: &gdk::Texture,
|
||||
blur_radius: Option<f32>,
|
||||
blur_cache: &Rc<RefCell<Option<gdk::Texture>>>,
|
||||
) -> gtk::Picture {
|
||||
let background = gtk::Picture::for_paintable(texture);
|
||||
fn create_background_picture(bg_path: &Path) -> gtk::Picture {
|
||||
let background = if bg_path.starts_with("/dev/moonarch/moonlock") {
|
||||
gtk::Picture::for_resource(bg_path.to_str().unwrap_or(""))
|
||||
} else {
|
||||
gtk::Picture::for_filename(bg_path.to_str().unwrap_or(""))
|
||||
};
|
||||
background.set_content_fit(gtk::ContentFit::Cover);
|
||||
background.set_hexpand(true);
|
||||
background.set_vexpand(true);
|
||||
|
||||
if let Some(sigma) = blur_radius {
|
||||
if sigma > 0.0 {
|
||||
let texture = texture.clone();
|
||||
let cache = blur_cache.clone();
|
||||
background.connect_realize(move |picture| {
|
||||
if let Some(ref cached) = *cache.borrow() {
|
||||
picture.set_paintable(Some(cached));
|
||||
return;
|
||||
}
|
||||
if let Some(blurred) = render_blurred_texture(picture, &texture, sigma) {
|
||||
picture.set_paintable(Some(&blurred));
|
||||
*cache.borrow_mut() = Some(blurred);
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
background
|
||||
}
|
||||
|
||||
// SYNC: MAX_BLUR_DIMENSION, render_blurred_texture, and create_background_picture
|
||||
// are duplicated in moongreet/src/greeter.rs and moonset/src/panel.rs.
|
||||
// Changes here must be mirrored to the other two projects.
|
||||
|
||||
/// Maximum texture dimension for blur input. Textures larger than this are
|
||||
/// downscaled before blurring — the blur destroys detail anyway, so there is
|
||||
/// no visible quality loss, but GPU work is reduced significantly.
|
||||
const MAX_BLUR_DIMENSION: f32 = 1920.0;
|
||||
|
||||
/// Render a blurred texture using the widget's GPU renderer.
|
||||
/// Returns None if the renderer is not available.
|
||||
///
|
||||
/// To avoid edge darkening (blur samples transparent pixels outside bounds),
|
||||
/// the texture is rendered with padding equal to 3x the blur sigma. The blur
|
||||
/// is applied to the padded area, then cropped back to the original size.
|
||||
///
|
||||
/// Large textures (> MAX_BLUR_DIMENSION) are downscaled before blurring to
|
||||
/// reduce GPU work. The sigma is scaled proportionally.
|
||||
fn render_blurred_texture(
|
||||
widget: &impl IsA<gtk::Widget>,
|
||||
texture: &gdk::Texture,
|
||||
sigma: f32,
|
||||
) -> Option<gdk::Texture> {
|
||||
let native = widget.native()?;
|
||||
let renderer = native.renderer()?;
|
||||
|
||||
let orig_w = texture.width() as f32;
|
||||
let orig_h = texture.height() as f32;
|
||||
|
||||
// Downscale large textures to reduce GPU blur work
|
||||
let max_dim = orig_w.max(orig_h);
|
||||
let scale = if max_dim > MAX_BLUR_DIMENSION {
|
||||
MAX_BLUR_DIMENSION / max_dim
|
||||
} else {
|
||||
1.0
|
||||
};
|
||||
let w = (orig_w * scale).round();
|
||||
let h = (orig_h * scale).round();
|
||||
let scaled_sigma = sigma * scale;
|
||||
|
||||
// Padding must cover the blur kernel radius (typically ~3x sigma)
|
||||
let pad = (scaled_sigma * 3.0).ceil();
|
||||
|
||||
let snapshot = gtk::Snapshot::new();
|
||||
// Clip output to scaled texture size
|
||||
snapshot.push_clip(&graphene::Rect::new(pad, pad, w, h));
|
||||
snapshot.push_blur(scaled_sigma as f64);
|
||||
// Render texture with padding on all sides (edges repeat via oversized bounds)
|
||||
snapshot.append_texture(texture, &graphene::Rect::new(-pad, -pad, w + 2.0 * pad, h + 2.0 * pad));
|
||||
snapshot.pop(); // blur
|
||||
snapshot.pop(); // clip
|
||||
|
||||
let node = snapshot.to_node()?;
|
||||
let viewport = graphene::Rect::new(pad, pad, w, h);
|
||||
Some(renderer.render_texture(&node, Some(&viewport)))
|
||||
}
|
||||
|
||||
/// Load an image file and set it as the avatar. Stores the texture in the cache.
|
||||
/// Decoding runs via GIO async I/O + async pixbuf stream loader so the GTK main
|
||||
/// loop stays responsive — avatars may be loaded inside the `connect_monitor`
|
||||
/// signal handler at hotplug time, which must not block. The fallback icon is
|
||||
/// shown immediately; the decoded texture replaces it when ready.
|
||||
fn set_avatar_from_file(
|
||||
image: >k::Image,
|
||||
path: &Path,
|
||||
cache: &Rc<RefCell<Option<gdk::Texture>>>,
|
||||
) {
|
||||
image.set_icon_name(Some("avatar-default-symbolic"));
|
||||
|
||||
let display_path = path.to_path_buf();
|
||||
let file = gio::File::for_path(path);
|
||||
let image_clone = image.clone();
|
||||
let cache_clone = cache.clone();
|
||||
|
||||
glib::spawn_future_local(async move {
|
||||
let stream = match file.read_future(glib::Priority::default()).await {
|
||||
Ok(s) => s,
|
||||
Err(e) => {
|
||||
log::warn!("Failed to open avatar {}: {e}", display_path.display());
|
||||
return;
|
||||
}
|
||||
};
|
||||
match Pixbuf::from_stream_at_scale_future(&stream, AVATAR_SIZE, AVATAR_SIZE, true).await {
|
||||
/// Load an image file and set it as the avatar.
|
||||
fn set_avatar_from_file(image: >k::Image, path: &Path) {
|
||||
match Pixbuf::from_file_at_scale(path.to_str().unwrap_or(""), AVATAR_SIZE, AVATAR_SIZE, true) {
|
||||
Ok(pixbuf) => {
|
||||
let texture = gdk::Texture::for_pixbuf(&pixbuf);
|
||||
image_clone.set_paintable(Some(&texture));
|
||||
*cache_clone.borrow_mut() = Some(texture);
|
||||
image.set_paintable(Some(&texture));
|
||||
}
|
||||
Err(e) => {
|
||||
log::warn!("Failed to decode avatar from {}: {e}", display_path.display());
|
||||
Err(_) => {
|
||||
image.set_icon_name(Some("avatar-default-symbolic"));
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/// Load the default avatar SVG from GResources, tinted with the foreground color.
|
||||
/// Stores the texture in the cache for reuse on additional monitors.
|
||||
fn set_default_avatar(
|
||||
image: >k::Image,
|
||||
window: >k::ApplicationWindow,
|
||||
cache: &Rc<RefCell<Option<gdk::Texture>>>,
|
||||
) {
|
||||
fn set_default_avatar(image: >k::Image, window: >k::ApplicationWindow) {
|
||||
let resource_path = users::get_default_avatar_path();
|
||||
if let Ok(bytes) =
|
||||
gio::resources_lookup_data(&resource_path, gio::ResourceLookupFlags::NONE)
|
||||
@ -715,7 +422,6 @@ fn set_default_avatar(
|
||||
if let Some(pixbuf) = loader.pixbuf() {
|
||||
let texture = gdk::Texture::for_pixbuf(&pixbuf);
|
||||
image.set_paintable(Some(&texture));
|
||||
*cache.borrow_mut() = Some(texture);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
221
src/main.rs
221
src/main.rs
@ -13,18 +13,16 @@ use gdk4 as gdk;
|
||||
use gtk4::prelude::*;
|
||||
use gtk4::{self as gtk, gio};
|
||||
use gtk4_session_lock;
|
||||
use std::cell::{Cell, RefCell};
|
||||
use std::path::PathBuf;
|
||||
use std::rc::Rc;
|
||||
|
||||
use crate::fingerprint::FingerprintListener;
|
||||
|
||||
fn load_css(display: &gdk::Display) {
|
||||
let css_provider = gtk::CssProvider::new();
|
||||
css_provider.load_from_resource("/dev/moonarch/moonlock/style.css");
|
||||
gtk::style_context_add_provider_for_display(
|
||||
display,
|
||||
&css_provider,
|
||||
gtk::STYLE_PROVIDER_PRIORITY_USER,
|
||||
gtk::STYLE_PROVIDER_PRIORITY_APPLICATION,
|
||||
);
|
||||
}
|
||||
|
||||
@ -40,14 +38,15 @@ fn activate(app: >k::Application) {
|
||||
load_css(&display);
|
||||
|
||||
let config = config::load_config(None);
|
||||
let bg_path = config::resolve_background_path(&config);
|
||||
|
||||
if gtk4_session_lock::is_supported() {
|
||||
activate_with_session_lock(app, &display, &config);
|
||||
activate_with_session_lock(app, &display, &bg_path, &config);
|
||||
} else {
|
||||
#[cfg(debug_assertions)]
|
||||
{
|
||||
log::warn!("ext-session-lock-v1 not supported — running in development mode");
|
||||
activate_without_lock(app, &config);
|
||||
activate_without_lock(app, &bg_path, &config);
|
||||
}
|
||||
#[cfg(not(debug_assertions))]
|
||||
{
|
||||
@ -59,209 +58,84 @@ fn activate(app: >k::Application) {
|
||||
|
||||
fn activate_with_session_lock(
|
||||
app: >k::Application,
|
||||
_display: &gdk::Display,
|
||||
display: &gdk::Display,
|
||||
bg_path: &PathBuf,
|
||||
config: &config::Config,
|
||||
) {
|
||||
let lock = gtk4_session_lock::Instance::new();
|
||||
lock.lock();
|
||||
|
||||
// Load wallpaper before lock — connect_monitor fires during lock() and needs the
|
||||
// texture. This means disk I/O happens before locking, but loading a local JPEG
|
||||
// is fast enough that the delay is negligible.
|
||||
let bg_texture: Rc<Option<gdk::Texture>> = Rc::new(
|
||||
config::resolve_background_path(config)
|
||||
.and_then(|path| lockscreen::load_background_texture(&path)),
|
||||
);
|
||||
let monitors = display.monitors();
|
||||
|
||||
// Shared unlock callback — unlocks session and quits.
|
||||
// Guard prevents double-unlock if PAM and fingerprint succeed simultaneously.
|
||||
// Shared unlock callback — unlocks session and quits
|
||||
let lock_clone = lock.clone();
|
||||
let app_clone = app.clone();
|
||||
let already_unlocked = Rc::new(Cell::new(false));
|
||||
let au = already_unlocked.clone();
|
||||
let unlock_callback: Rc<dyn Fn()> = Rc::new(move || {
|
||||
if au.get() {
|
||||
log::debug!("Unlock already triggered, ignoring duplicate");
|
||||
return;
|
||||
}
|
||||
au.set(true);
|
||||
lock_clone.unlock();
|
||||
app_clone.quit();
|
||||
});
|
||||
|
||||
// Shared caches for multi-monitor — first monitor renders, rest reuse
|
||||
let blur_cache: Rc<RefCell<Option<gdk::Texture>>> = Rc::new(RefCell::new(None));
|
||||
let avatar_cache: Rc<RefCell<Option<gdk::Texture>>> = Rc::new(RefCell::new(None));
|
||||
|
||||
// Shared config for use in the monitor signal handler
|
||||
let config = Rc::new(config.clone());
|
||||
|
||||
// Shared handles list — populated by connect_monitor, read by fingerprint init
|
||||
let all_handles: Rc<RefCell<Vec<lockscreen::LockscreenHandles>>> =
|
||||
Rc::new(RefCell::new(Vec::new()));
|
||||
|
||||
// Shared fingerprint listener — None until async init completes.
|
||||
// The monitor handler checks this to wire up FP labels on hotplugged monitors.
|
||||
let shared_fp: Rc<RefCell<Option<Rc<RefCell<FingerprintListener>>>>> =
|
||||
Rc::new(RefCell::new(None));
|
||||
|
||||
// The ::monitor signal fires once per existing monitor at lock(), and again
|
||||
// whenever a monitor is hotplugged (e.g. after suspend/resume). This replaces
|
||||
// the old manual monitor iteration and handles hotplug automatically.
|
||||
let lock_for_signal = lock.clone();
|
||||
lock.connect_monitor(glib::clone!(
|
||||
#[strong]
|
||||
app,
|
||||
#[strong]
|
||||
config,
|
||||
#[strong]
|
||||
bg_texture,
|
||||
#[strong]
|
||||
unlock_callback,
|
||||
#[strong]
|
||||
blur_cache,
|
||||
#[strong]
|
||||
avatar_cache,
|
||||
#[strong]
|
||||
all_handles,
|
||||
#[strong]
|
||||
shared_fp,
|
||||
move |_instance, monitor| {
|
||||
log::debug!("Monitor signal: creating lockscreen window");
|
||||
let handles = lockscreen::create_lockscreen_window(
|
||||
bg_texture.as_ref().as_ref(),
|
||||
&config,
|
||||
&app,
|
||||
unlock_callback.clone(),
|
||||
&blur_cache,
|
||||
&avatar_cache,
|
||||
);
|
||||
lock_for_signal.assign_window_to_monitor(&handles.window, monitor);
|
||||
handles.window.present();
|
||||
|
||||
// If fingerprint is already initialized, wire up the label
|
||||
if let Some(ref fp_rc) = *shared_fp.borrow() {
|
||||
lockscreen::show_fingerprint_label(&handles, fp_rc);
|
||||
}
|
||||
|
||||
all_handles.borrow_mut().push(handles);
|
||||
}
|
||||
));
|
||||
|
||||
lock.lock();
|
||||
|
||||
// Async fprintd initialization — runs after windows are visible
|
||||
if config.fingerprint_enabled {
|
||||
init_fingerprint_async(all_handles, shared_fp);
|
||||
}
|
||||
}
|
||||
|
||||
/// Initialize fprintd asynchronously after windows are visible.
|
||||
/// Uses a single FingerprintListener shared across all monitors —
|
||||
/// only the first monitor's handles get the fingerprint verification wired up.
|
||||
/// The `shared_fp` is set after init so that the connect_monitor handler can
|
||||
/// wire up FP labels on monitors that appear after initialization.
|
||||
fn init_fingerprint_async(
|
||||
all_handles: Rc<RefCell<Vec<lockscreen::LockscreenHandles>>>,
|
||||
shared_fp: Rc<RefCell<Option<Rc<RefCell<FingerprintListener>>>>>,
|
||||
) {
|
||||
glib::spawn_future_local(async move {
|
||||
let mut listener = FingerprintListener::new();
|
||||
listener.init_async().await;
|
||||
|
||||
// Extract username without holding a borrow across the await below —
|
||||
// otherwise a concurrent connect_monitor signal (hotplug / suspend-resume)
|
||||
// that tries to borrow_mut() panics at runtime.
|
||||
let username = {
|
||||
let handles = all_handles.borrow();
|
||||
if handles.is_empty() {
|
||||
return;
|
||||
}
|
||||
let u = handles[0].username.clone();
|
||||
if u.is_empty() {
|
||||
return;
|
||||
}
|
||||
u
|
||||
};
|
||||
|
||||
if !listener.is_available_async(&username).await {
|
||||
log::debug!("fprintd not available or no enrolled fingers");
|
||||
return;
|
||||
}
|
||||
|
||||
let fp_rc = Rc::new(RefCell::new(listener));
|
||||
|
||||
// Re-borrow after the await — no further awaits in this scope, so it is
|
||||
// safe to hold the borrow briefly while wiring up the labels.
|
||||
let mut created_any = false;
|
||||
for i in 0..monitors.n_items() {
|
||||
if let Some(monitor) = monitors
|
||||
.item(i)
|
||||
.and_then(|obj| obj.downcast::<gdk::Monitor>().ok())
|
||||
{
|
||||
let handles = all_handles.borrow();
|
||||
for h in handles.iter() {
|
||||
lockscreen::show_fingerprint_label(h, &fp_rc);
|
||||
let window = lockscreen::create_lockscreen_window(
|
||||
bg_path,
|
||||
config,
|
||||
app,
|
||||
unlock_callback.clone(),
|
||||
);
|
||||
lock.assign_window_to_monitor(&window, &monitor);
|
||||
window.present();
|
||||
created_any = true;
|
||||
}
|
||||
lockscreen::start_fingerprint(&handles[0], &fp_rc);
|
||||
}
|
||||
|
||||
// Publish the listener so hotplugged monitors get FP labels too
|
||||
*shared_fp.borrow_mut() = Some(fp_rc);
|
||||
});
|
||||
if !created_any {
|
||||
log::error!("No lockscreen windows created — screen stays locked (compositor policy)");
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(debug_assertions)]
|
||||
fn activate_without_lock(
|
||||
app: >k::Application,
|
||||
bg_path: &PathBuf,
|
||||
config: &config::Config,
|
||||
) {
|
||||
let bg_texture = config::resolve_background_path(config)
|
||||
.and_then(|path| lockscreen::load_background_texture(&path));
|
||||
|
||||
let app_clone = app.clone();
|
||||
let unlock_callback: Rc<dyn Fn()> = Rc::new(move || {
|
||||
app_clone.quit();
|
||||
});
|
||||
|
||||
let blur_cache = Rc::new(RefCell::new(None));
|
||||
let avatar_cache = Rc::new(RefCell::new(None));
|
||||
let handles = lockscreen::create_lockscreen_window(
|
||||
bg_texture.as_ref(),
|
||||
let window = lockscreen::create_lockscreen_window(
|
||||
bg_path,
|
||||
config,
|
||||
app,
|
||||
unlock_callback,
|
||||
&blur_cache,
|
||||
&avatar_cache,
|
||||
);
|
||||
handles.window.set_default_size(800, 600);
|
||||
handles.window.present();
|
||||
|
||||
// Async fprintd initialization for development mode
|
||||
if config.fingerprint_enabled {
|
||||
let all_handles = Rc::new(RefCell::new(vec![handles]));
|
||||
let shared_fp = Rc::new(RefCell::new(None));
|
||||
init_fingerprint_async(all_handles, shared_fp);
|
||||
}
|
||||
window.set_default_size(800, 600);
|
||||
window.present();
|
||||
}
|
||||
|
||||
fn setup_logging() {
|
||||
match systemd_journal_logger::JournalLog::new() {
|
||||
Ok(logger) => {
|
||||
if let Err(e) = logger.install() {
|
||||
eprintln!("Failed to install journal logger: {e}");
|
||||
let mut builder = env_logger::Builder::from_default_env();
|
||||
builder.filter_level(log::LevelFilter::Info);
|
||||
|
||||
let log_dir = PathBuf::from("/var/cache/moonlock");
|
||||
if log_dir.is_dir() {
|
||||
let log_file = log_dir.join("moonlock.log");
|
||||
if let Ok(file) = std::fs::OpenOptions::new()
|
||||
.create(true)
|
||||
.append(true)
|
||||
.open(&log_file)
|
||||
{
|
||||
builder.target(env_logger::Target::Pipe(Box::new(file)));
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
eprintln!("Failed to create journal logger: {e}");
|
||||
}
|
||||
}
|
||||
// Debug level is only selectable in debug builds. Release binaries ignore
|
||||
// MOONLOCK_DEBUG so a session script cannot escalate log verbosity to leak
|
||||
// fprintd / D-Bus internals into the journal.
|
||||
#[cfg(debug_assertions)]
|
||||
let level = if std::env::var("MOONLOCK_DEBUG").is_ok() {
|
||||
log::LevelFilter::Debug
|
||||
} else {
|
||||
log::LevelFilter::Info
|
||||
};
|
||||
#[cfg(not(debug_assertions))]
|
||||
let level = log::LevelFilter::Info;
|
||||
log::set_max_level(level);
|
||||
|
||||
builder.init();
|
||||
}
|
||||
|
||||
fn install_panic_hook() {
|
||||
@ -276,7 +150,6 @@ fn install_panic_hook() {
|
||||
}
|
||||
|
||||
fn main() {
|
||||
install_panic_hook();
|
||||
setup_logging();
|
||||
|
||||
// Root check — moonlock should not run as root
|
||||
@ -284,6 +157,8 @@ fn main() {
|
||||
log::error!("Moonlock should not run as root");
|
||||
std::process::exit(1);
|
||||
}
|
||||
|
||||
install_panic_hook();
|
||||
log::info!("Moonlock starting");
|
||||
|
||||
// Register compiled GResources
|
||||
|
||||
16
src/power.rs
16
src/power.rs
@ -1,4 +1,4 @@
|
||||
// ABOUTME: Power actions — reboot and shutdown via systemctl.
|
||||
// ABOUTME: Power actions — reboot and shutdown via loginctl.
|
||||
// ABOUTME: Wrappers around system commands for the lockscreen UI.
|
||||
|
||||
use std::fmt;
|
||||
@ -7,12 +7,14 @@ use std::process::Command;
|
||||
#[derive(Debug)]
|
||||
pub enum PowerError {
|
||||
CommandFailed { action: &'static str, message: String },
|
||||
Timeout { action: &'static str },
|
||||
}
|
||||
|
||||
impl fmt::Display for PowerError {
|
||||
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
|
||||
match self {
|
||||
PowerError::CommandFailed { action, message } => write!(f, "{action} failed: {message}"),
|
||||
PowerError::Timeout { action } => write!(f, "{action} timed out"),
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -20,10 +22,11 @@ impl fmt::Display for PowerError {
|
||||
impl std::error::Error for PowerError {}
|
||||
|
||||
fn run_command(action: &'static str, program: &str, args: &[&str]) -> Result<(), PowerError> {
|
||||
let output = Command::new(program)
|
||||
let child = Command::new(program)
|
||||
.args(args)
|
||||
.stderr(std::process::Stdio::piped())
|
||||
.output()
|
||||
.spawn()
|
||||
.map_err(|e| PowerError::CommandFailed { action, message: e.to_string() })?;
|
||||
let output = child.wait_with_output()
|
||||
.map_err(|e| PowerError::CommandFailed { action, message: e.to_string() })?;
|
||||
if !output.status.success() {
|
||||
let stderr = String::from_utf8_lossy(&output.stderr);
|
||||
@ -34,14 +37,15 @@ fn run_command(action: &'static str, program: &str, args: &[&str]) -> Result<(),
|
||||
Ok(())
|
||||
}
|
||||
|
||||
pub fn reboot() -> Result<(), PowerError> { run_command("reboot", "/usr/bin/systemctl", &["--no-ask-password", "reboot"]) }
|
||||
pub fn shutdown() -> Result<(), PowerError> { run_command("shutdown", "/usr/bin/systemctl", &["--no-ask-password", "poweroff"]) }
|
||||
pub fn reboot() -> Result<(), PowerError> { run_command("reboot", "/usr/bin/loginctl", &["reboot"]) }
|
||||
pub fn shutdown() -> Result<(), PowerError> { run_command("shutdown", "/usr/bin/loginctl", &["poweroff"]) }
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test] fn power_error_display() { assert_eq!(PowerError::CommandFailed { action: "reboot", message: "fail".into() }.to_string(), "reboot failed: fail"); }
|
||||
#[test] fn timeout_display() { assert_eq!(PowerError::Timeout { action: "shutdown" }.to_string(), "shutdown timed out"); }
|
||||
#[test] fn missing_binary() { assert!(run_command("test", "nonexistent-xyz", &[]).is_err()); }
|
||||
#[test] fn nonzero_exit() { assert!(run_command("test", "false", &[]).is_err()); }
|
||||
#[test] fn success() { assert!(run_command("test", "true", &[]).is_ok()); }
|
||||
|
||||
18
src/users.rs
18
src/users.rs
@ -18,13 +18,7 @@ pub struct User {
|
||||
pub fn get_current_user() -> Option<User> {
|
||||
let uid = getuid();
|
||||
let nix_user = NixUser::from_uid(uid).ok()??;
|
||||
let gecos = match nix_user.gecos.to_str() {
|
||||
Ok(s) => s.to_string(),
|
||||
Err(_) => {
|
||||
log::warn!("GECOS field is not valid UTF-8, falling back to username");
|
||||
String::new()
|
||||
}
|
||||
};
|
||||
let gecos = nix_user.gecos.to_str().unwrap_or("").to_string();
|
||||
let display_name = if !gecos.is_empty() {
|
||||
let first = gecos.split(',').next().unwrap_or("");
|
||||
if first.is_empty() { nix_user.name.clone() } else { first.to_string() }
|
||||
@ -37,17 +31,13 @@ pub fn get_avatar_path(home: &Path, username: &str) -> Option<PathBuf> {
|
||||
}
|
||||
|
||||
pub fn get_avatar_path_with(home: &Path, username: &str, accountsservice_dir: &Path) -> Option<PathBuf> {
|
||||
// ~/.face takes priority — single stat via symlink_metadata to avoid TOCTOU
|
||||
// ~/.face takes priority
|
||||
let face = home.join(".face");
|
||||
if let Ok(meta) = face.symlink_metadata() {
|
||||
if meta.is_file() && !meta.file_type().is_symlink() { return Some(face); }
|
||||
}
|
||||
if face.exists() && !face.is_symlink() { return Some(face); }
|
||||
// AccountsService icon
|
||||
if accountsservice_dir.exists() {
|
||||
let icon = accountsservice_dir.join(username);
|
||||
if let Ok(meta) = icon.symlink_metadata() {
|
||||
if meta.is_file() && !meta.file_type().is_symlink() { return Some(icon); }
|
||||
}
|
||||
if icon.exists() && !icon.is_symlink() { return Some(icon); }
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user