0.8.0

data: Stop privilege escalations in daemon
Using the NoNewPrivileges stanza from systemd.
2026-04-08 20:03:34 +02:00 · 2017-09-13 16:27:53 +02:00 · 2017-09-13 15:48:17 +02:00 · 2017-02-16 15:51:22 +01:00 · 2017-02-16 15:44:12 +01:00 · 2017-02-16 14:49:58 +01:00
18 changed files with 129 additions and 372 deletions
--- a/4
+++ b/4
@ -1,6 +1,10 @@
 This file lists notable changes in each release. For the full history of all
 changes, see ChangeLog.

+version 0.8.0:
+- Lockdown the daemon to minimise potential security issues
+- Don't wake up readers when there's no enrolled fingerprints
+
 version 0.7.0:
 - Fix crash in the daemon when cancelling PAM conversation
 - Fix build warnings and update translations
--- a/configure.ac
+++ b/configure.ac
@ -1,4 +1,4 @@
-AC_INIT([fprintd], [0.7.0])
+AC_INIT([fprintd], [0.8.0])
 AM_INIT_AUTOMAKE([1.11 dist-xz no-dist-gzip check-news])
 AC_CONFIG_SRCDIR([src/main.c])
 AC_CONFIG_HEADERS([config.h])
--- a/data/Makefile.am
+++ b/data/Makefile.am
@ -15,7 +15,7 @@ if HAVE_SYSTEMD
 systemdservicedir       = $(systemdsystemunitdir)
 systemdservice_DATA     = $(systemdservice_in_files:.service.in=.service)
 $(systemdservice_DATA): $(systemdservice_in_files) Makefile
-	@sed -e "s|\@libexecdir\@|$(libexecdir)|" $< > $@
+	@sed -e "s|\@libexecdir\@|$(libexecdir)|" -e "s|\@localstatedir\@|$(localstatedir)|" $< > $@
 endif

 polkitdir = $(datadir)/polkit-1/actions
--- a/data/fprintd.service.in
+++ b/data/fprintd.service.in
@ -6,3 +6,26 @@ Documentation=man:fprintd(1)
 Type=dbus
 BusName=net.reactivated.Fprint
 ExecStart=@libexecdir@/fprintd
+
+# Filesystem lockdown
+ProtectSystem=strict
+ProtectKernelTunables=true
+ProtectControlGroups=true
+ReadWritePaths=@localstatedir@/lib/fprint
+ProtectHome=true
+PrivateTmp=true
+
+# Network
+PrivateNetwork=true
+
+# Execute Mappings
+MemoryDenyWriteExecute=true
+
+# Modules
+ProtectKernelModules=true
+
+# Real-time
+RestrictRealtime=true
+
+# Privilege escalation
+NoNewPrivileges=true
--- a/pam/pam_fprintd.c
+++ b/pam/pam_fprintd.c
@ -183,7 +183,7 @@ static void unref_loop (GMainLoop *loop)

 #define DBUS_TYPE_G_OBJECT_PATH_ARRAY (dbus_g_type_get_collection ("GPtrArray", DBUS_TYPE_G_OBJECT_PATH))

-static DBusGProxy *open_device(pam_handle_t *pamh, DBusGConnection *connection, DBusGProxy *manager, const char *username, gboolean *has_multiple_devices)
+static DBusGProxy *open_device(pam_handle_t *pamh, DBusGConnection *connection, DBusGProxy *manager, gboolean *has_multiple_devices)
 {
 	GError *error = NULL;
 	const char *path;
@ -217,13 +217,6 @@ static DBusGProxy *open_device(pam_handle_t *pamh, DBusGConnection *connection,
 					path,
 					"net.reactivated.Fprint.Device");

-	if (!dbus_g_proxy_call (dev, "Claim", &error, G_TYPE_STRING, username, G_TYPE_INVALID, G_TYPE_INVALID)) {
-		D(pamh, "failed to claim device '%s': %s\n", path, error->message);
-		g_error_free (error);
-		g_object_unref (dev);
-		dev = NULL;
-	}
-
 	g_ptr_array_free (paths_array, TRUE);

 	return dev;
@ -383,6 +376,26 @@ static int do_verify(GMainLoop *loop, pam_handle_t *pamh, DBusGProxy *dev, gbool
 	return ret;
 }

+static gboolean user_has_prints(DBusGProxy *dev, const char *username)
+{
+	char **fingers;
+	gboolean have_prints;
+
+	if (!dbus_g_proxy_call (dev, "ListEnrolledFingers", NULL,
+				G_TYPE_STRING, username, G_TYPE_INVALID,
+				G_TYPE_STRV, &fingers, G_TYPE_INVALID)) {
+		/* If ListEnrolledFingers fails then verification should
+		 * also fail (both use the same underlying call), so we
+		 * report FALSE here and bail out early.  */
+		return FALSE;
+	}
+
+	have_prints = fingers != NULL && g_strv_length (fingers) > 0;
+	g_strfreev (fingers);
+
+	return have_prints;
+}
+
 static void release_device(pam_handle_t *pamh, DBusGProxy *dev)
 {
 	GError *error = NULL;
@ -392,30 +405,52 @@ static void release_device(pam_handle_t *pamh, DBusGProxy *dev)
 	}
 }

+static gboolean claim_device(pam_handle_t *pamh, DBusGProxy *dev, const char *username)
+{
+	GError *error = NULL;
+
+	if (!dbus_g_proxy_call (dev, "Claim", &error, G_TYPE_STRING, username, G_TYPE_INVALID, G_TYPE_INVALID)) {
+		D(pamh, "failed to claim device %s\n", error->message);
+		g_error_free (error);
+		return FALSE;
+	}
+
+	return TRUE;
+}
+
 static int do_auth(pam_handle_t *pamh, const char *username)
 {
 	DBusGProxy *manager;
 	DBusGConnection *connection;
 	DBusGProxy *dev;
 	GMainLoop *loop;
+	gboolean have_prints;
 	gboolean has_multiple_devices;
-	int ret;
+	int ret = PAM_AUTHINFO_UNAVAIL;

 	manager = create_manager (pamh, &connection, &loop);
 	if (manager == NULL)
 		return PAM_AUTHINFO_UNAVAIL;

-	dev = open_device(pamh, connection, manager, username, &has_multiple_devices);
+	dev = open_device(pamh, connection, manager, &has_multiple_devices);
 	g_object_unref (manager);
 	if (!dev) {
 		unref_loop (loop);
 		close_and_unref (connection);
 		return PAM_AUTHINFO_UNAVAIL;
 	}
-	ret = do_verify(loop, pamh, dev, has_multiple_devices);
+
+	have_prints = user_has_prints(dev, username);
+	D(pamh, "prints registered: %s\n", have_prints ? "yes" : "no");
+
+	if (have_prints) {
+		if (claim_device (pamh, dev, username)) {
+			ret = do_verify (loop, pamh, dev, has_multiple_devices);
+			release_device (pamh, dev);
+		}
+	}

 	unref_loop (loop);
-	release_device(pamh, dev);
 	g_object_unref (dev);
 	close_and_unref (connection);

@ -433,7 +468,9 @@ PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
 	bindtextdomain (GETTEXT_PACKAGE, LOCALEDIR);
 	bind_textdomain_codeset (GETTEXT_PACKAGE, "UTF-8");

-	g_type_init ();
+#if !GLIB_CHECK_VERSION (2, 36, 0)
+	g_type_init();
+#endif

 	dbus_g_object_register_marshaller (fprintd_marshal_VOID__STRING_BOOLEAN,
 					   G_TYPE_NONE, G_TYPE_STRING, G_TYPE_BOOLEAN, G_TYPE_INVALID);
--- a/po/LINGUAS
+++ b/po/LINGUAS
@ -1,7 +1,7 @@
 ar
 as
 az
-bg_BG
+bg
 bn_IN
 ca
 ca@valencia
@ -15,10 +15,10 @@ eo
 es
 et
 eu
-fa_IR
+fa
 fi
-fr
 fo
+fr
 ga
 gl
 gu
@ -26,6 +26,7 @@ he
 hi
 hr
 hu
+ia
 id
 it
 ja
@ -45,6 +46,7 @@ oc
 or
 pa
 pl
+pt
 pt_BR
 ro
 ru
--- a/po/bg_BG.po
+++ b/po/bg_BG.po
@ -1,172 +0,0 @@
-# SOME DESCRIPTIVE TITLE.
-# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PACKAGE package.
-# 
-# Translators:
-msgid ""
-msgstr ""
-"Project-Id-Version: fprintd\n"
-"Report-Msgid-Bugs-To: https://bugs.freedesktop.org/enter_bug.cgi?product=libfprint\n"
-"POT-Creation-Date: 2011-04-18 17:52+0100\n"
-"PO-Revision-Date: 2010-11-30 07:44+0000\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
-"Language-Team: Bulgarian (Bulgaria) (http://www.transifex.net/projects/p/freedesktop/language/bg_BG/)\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"Language: bg_BG\n"
-"Plural-Forms: nplurals=2; plural=(n != 1)\n"
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:1
-msgid "Enroll new fingerprints"
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:2
-msgid "Privileges are required to enroll new fingerprints for other users."
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:3
-msgid "Privileges are required to enroll new fingerprints."
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:4
-msgid "Privileges are required to verify fingerprints."
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:5
-msgid "Select a user to enroll"
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:6
-msgid "Verify a fingerprint"
-msgstr ""
-
-#: ../src/device.c:385
-#, c-format
-msgid "Device was not claimed before use"
-msgstr ""
-
-#: ../src/device.c:395
-#, c-format
-msgid "Device already in use by another user"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:28
-#, c-format
-msgid "Place your left thumb on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:28
-#, c-format
-msgid "Swipe your left thumb on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:29
-#, c-format
-msgid "Place your left index finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:29
-#, c-format
-msgid "Swipe your left index finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:30
-#, c-format
-msgid "Place your left middle finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:30
-#, c-format
-msgid "Swipe your left middle finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:31
-#, c-format
-msgid "Place your left ring finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:31
-#, c-format
-msgid "Swipe your left ring finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:32
-#, c-format
-msgid "Place your left little finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:32
-#, c-format
-msgid "Swipe your left little finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:33
-#, c-format
-msgid "Place your right thumb on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:33
-#, c-format
-msgid "Swipe your right thumb on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:34
-#, c-format
-msgid "Place your right index finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:34
-#, c-format
-msgid "Swipe your right index finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:35
-#, c-format
-msgid "Place your right middle finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:35
-#, c-format
-msgid "Swipe your right middle finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:36
-#, c-format
-msgid "Place your right ring finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:36
-#, c-format
-msgid "Swipe your right ring finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:37
-#, c-format
-msgid "Place your right little finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:37
-#, c-format
-msgid "Swipe your right little finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:72 ../pam/fingerprint-strings.h:98
-msgid "Place your finger on the reader again"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:74 ../pam/fingerprint-strings.h:100
-msgid "Swipe your finger again"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:77 ../pam/fingerprint-strings.h:103
-msgid "Swipe was too short, try again"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:79 ../pam/fingerprint-strings.h:105
-msgid "Your finger was not centered, try swiping your finger again"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:81 ../pam/fingerprint-strings.h:107
-msgid "Remove your finger, and try swiping your finger again"
-msgstr ""
--- a/po/fa_IR.po
+++ b/po/fa_IR.po
@ -1,172 +0,0 @@
-# SOME DESCRIPTIVE TITLE.
-# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PACKAGE package.
-# 
-# Translators:
-msgid ""
-msgstr ""
-"Project-Id-Version: fprintd\n"
-"Report-Msgid-Bugs-To: https://bugs.freedesktop.org/enter_bug.cgi?product=libfprint\n"
-"POT-Creation-Date: 2011-04-18 17:52+0100\n"
-"PO-Revision-Date: 2010-11-30 07:44+0000\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
-"Language-Team: Persian (Iran) (http://www.transifex.net/projects/p/freedesktop/language/fa_IR/)\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"Language: fa_IR\n"
-"Plural-Forms: nplurals=1; plural=0\n"
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:1
-msgid "Enroll new fingerprints"
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:2
-msgid "Privileges are required to enroll new fingerprints for other users."
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:3
-msgid "Privileges are required to enroll new fingerprints."
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:4
-msgid "Privileges are required to verify fingerprints."
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:5
-msgid "Select a user to enroll"
-msgstr ""
-
-#: ../data/net.reactivated.fprint.device.policy.in.h:6
-msgid "Verify a fingerprint"
-msgstr ""
-
-#: ../src/device.c:385
-#, c-format
-msgid "Device was not claimed before use"
-msgstr ""
-
-#: ../src/device.c:395
-#, c-format
-msgid "Device already in use by another user"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:28
-#, c-format
-msgid "Place your left thumb on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:28
-#, c-format
-msgid "Swipe your left thumb on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:29
-#, c-format
-msgid "Place your left index finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:29
-#, c-format
-msgid "Swipe your left index finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:30
-#, c-format
-msgid "Place your left middle finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:30
-#, c-format
-msgid "Swipe your left middle finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:31
-#, c-format
-msgid "Place your left ring finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:31
-#, c-format
-msgid "Swipe your left ring finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:32
-#, c-format
-msgid "Place your left little finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:32
-#, c-format
-msgid "Swipe your left little finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:33
-#, c-format
-msgid "Place your right thumb on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:33
-#, c-format
-msgid "Swipe your right thumb on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:34
-#, c-format
-msgid "Place your right index finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:34
-#, c-format
-msgid "Swipe your right index finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:35
-#, c-format
-msgid "Place your right middle finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:35
-#, c-format
-msgid "Swipe your right middle finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:36
-#, c-format
-msgid "Place your right ring finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:36
-#, c-format
-msgid "Swipe your right ring finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:37
-#, c-format
-msgid "Place your right little finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:37
-#, c-format
-msgid "Swipe your right little finger on %s"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:72 ../pam/fingerprint-strings.h:98
-msgid "Place your finger on the reader again"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:74 ../pam/fingerprint-strings.h:100
-msgid "Swipe your finger again"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:77 ../pam/fingerprint-strings.h:103
-msgid "Swipe was too short, try again"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:79 ../pam/fingerprint-strings.h:105
-msgid "Your finger was not centered, try swiping your finger again"
-msgstr ""
-
-#: ../pam/fingerprint-strings.h:81 ../pam/fingerprint-strings.h:107
-msgid "Remove your finger, and try swiping your finger again"
-msgstr ""
--- a/po/ja.po
+++ b/po/ja.po
@ -3,14 +3,14 @@
 # This file is distributed under the same license as the PACKAGE package.
 # 
 # Translators:
-# Tomoyuki KATO <tomo@dream.daynight.jp>, 2011, 2012
+# Tomoyuki KATO <inactive+katomo@transifex.com>, 2011, 2012
 msgid ""
 msgstr ""
 "Project-Id-Version: fprintd\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2016-10-13 17:12+0200\n"
 "PO-Revision-Date: 2013-11-20 10:37+0000\n"
-"Last-Translator: Tomoyuki KATO <tomo@dream.daynight.jp>\n"
+"Last-Translator: Tomoyuki KATO <inactive+katomo@transifex.com>\n"
 "Language-Team: Japanese (http://www.transifex.com/freedesktop/fprintd/language/ja/)\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
--- a/po/tr.po
+++ b/po/tr.po
@ -3,7 +3,7 @@
 # This file is distributed under the same license as the PACKAGE package.
 # 
 # Translators:
-# Caner Başaran <basaran.caner@gmail.com>, 2014
+# Caner Başaran <basaran.caner@protonmail.com>, 2014
 msgid ""
 msgstr ""
 "Project-Id-Version: fprintd\n"
--- a/src/Makefile.am
+++ b/src/Makefile.am
@ -7,7 +7,13 @@ EXTRA_DIST = manager.xml device.xml fprintd-marshal.list
 libexec_PROGRAMS = fprintd
 noinst_LTLIBRARIES = libfprintd.la

-AM_CFLAGS = $(WARN_CFLAGS) $(FPRINT_CFLAGS) $(DAEMON_CFLAGS) -DLOCALEDIR=\""$(datadir)/locale"\" -DPLUGINDIR=\""$(libdir)/fprintd/modules"\"
+AM_CFLAGS =						\
+	$(WARN_CFLAGS)					\
+	$(FPRINT_CFLAGS)				\
+	$(DAEMON_CFLAGS)				\
+	-DLOCALEDIR=\""$(datadir)/locale"\"		\
+	-DPLUGINDIR=\""$(libdir)/fprintd/modules"\"	\
+	-DFILE_STORAGE_PATH=\""$(localstatedir)/lib/fprint"\"

 libfprintd_la_SOURCES =				\
 	manager.c device.c			\
--- a/src/device.c
+++ b/src/device.c
@ -402,7 +402,7 @@ static gboolean
 _fprint_device_check_polkit_for_action (FprintDevice *rdev, DBusGMethodInvocation *context, const char *action, GError **error)
 {
 	FprintDevicePrivate *priv = DEVICE_GET_PRIVATE(rdev);
-	const char *sender;
+	char *sender;
 	PolkitSubject *subject;
 	PolkitAuthorizationResult *result;
 	GError *_error = NULL;
@ -410,6 +410,7 @@ _fprint_device_check_polkit_for_action (FprintDevice *rdev, DBusGMethodInvocatio
 	/* Check that caller is privileged */
 	sender = dbus_g_method_get_sender (context);
 	subject = polkit_system_bus_name_new (sender);
+	g_free (sender);

 	result = polkit_authority_check_authorization_sync (priv->auth,
                                                            subject,
@ -603,7 +604,7 @@ static void dev_open_cb(struct fp_dev *dev, int status, void *user_data)
 	g_message("device %d claim status %d", priv->id, status);

 	if (status != 0) {
-		GError *error;
+		GError *error = NULL;

 		g_free (priv->sender);
 		priv->sender = NULL;
@ -611,6 +612,7 @@ static void dev_open_cb(struct fp_dev *dev, int status, void *user_data)
 		g_set_error(&error, FPRINT_ERROR, FPRINT_ERROR_INTERNAL,
 			"Open failed with error %d", status);
 		dbus_g_method_return_error(session->context_claim_device, error);
+		g_error_free(error);
 		return;
 	}

@ -632,6 +634,7 @@ static void fprint_device_claim(FprintDevice *rdev,
 		g_set_error(&error, FPRINT_ERROR, FPRINT_ERROR_ALREADY_IN_USE,
 			    "Device was already claimed");
 		dbus_g_method_return_error(context, error);
+		g_error_free(error);
 		return;
 	}

@ -658,6 +661,7 @@ static void fprint_device_claim(FprintDevice *rdev,
 		g_free (sender);
 		g_free (user);
 		dbus_g_method_return_error (context, error);
+		g_error_free (error);
 		return;
 	}

@ -684,6 +688,7 @@ static void fprint_device_claim(FprintDevice *rdev,
 		g_set_error(&error, FPRINT_ERROR, FPRINT_ERROR_INTERNAL,
 			"Could not attempt device open, error %d", r);
 		dbus_g_method_return_error(context, error);
+		g_error_free(error);
 	}
 }

@ -717,6 +722,7 @@ static void fprint_device_release(FprintDevice *rdev,

 	if (_fprint_device_check_claimed(rdev, context, &error) == FALSE) {
 		dbus_g_method_return_error (context, error);
+		g_error_free(error);
 		return;
 	}

@ -726,6 +732,7 @@ static void fprint_device_release(FprintDevice *rdev,
 						     "net.reactivated.fprint.device.enroll",
 						     &error) == FALSE) {
 		dbus_g_method_return_error (context, error);
+		g_error_free(error);
 		return;
 	}

@ -829,6 +836,7 @@ static void fprint_device_verify_start(FprintDevice *rdev,
 			g_set_error(&error, FPRINT_ERROR, FPRINT_ERROR_NO_ENROLLED_PRINTS,
 				    "No fingerprints enrolled");
 			dbus_g_method_return_error(context, error);
+			g_error_free(error);
 			return;
 		}
 		if (fp_dev_supports_identification(priv->dev)) {
@ -882,6 +890,7 @@ static void fprint_device_verify_start(FprintDevice *rdev,
 			g_set_error(&error, FPRINT_ERROR, FPRINT_ERROR_INTERNAL,
 				    "No such print %d", finger_num);
 			dbus_g_method_return_error(context, error);
+			g_error_free(error);
 			return;
 		}

@ -906,6 +915,7 @@ static void fprint_device_verify_start(FprintDevice *rdev,
 		g_set_error(&error, FPRINT_ERROR, FPRINT_ERROR_INTERNAL,
 			"Verify start failed with error %d", r);
 		dbus_g_method_return_error(context, error);
+		g_error_free(error);
 		return;
 	}
 	priv->verify_data = data;
@ -933,11 +943,13 @@ static void fprint_device_verify_stop(FprintDevice *rdev,

 	if (_fprint_device_check_claimed(rdev, context, &error) == FALSE) {
 		dbus_g_method_return_error (context, error);
+		g_error_free(error);
 		return;
 	}

 	if (_fprint_device_check_polkit_for_action (rdev, context, "net.reactivated.fprint.device.verify", &error) == FALSE) {
 		dbus_g_method_return_error (context, error);
+		g_error_free(error);
 		return;
 	}

@ -1031,11 +1043,13 @@ static void fprint_device_enroll_start(FprintDevice *rdev,

 	if (_fprint_device_check_claimed(rdev, context, &error) == FALSE) {
 		dbus_g_method_return_error (context, error);
+		g_error_free (error);
 		return;
 	}

 	if (_fprint_device_check_polkit_for_action (rdev, context, "net.reactivated.fprint.device.enroll", &error) == FALSE) {
 		dbus_g_method_return_error (context, error);
+		g_error_free (error);
 		return;
 	}

@ -1061,6 +1075,7 @@ static void fprint_device_enroll_start(FprintDevice *rdev,
 		g_set_error(&error, FPRINT_ERROR, FPRINT_ERROR_INTERNAL,
 			"Enroll start failed with error %d", r);
 		dbus_g_method_return_error(context, error);
+		g_error_free(error);
 		return;
 	}

@ -1083,11 +1098,13 @@ static void fprint_device_enroll_stop(FprintDevice *rdev,

 	if (_fprint_device_check_claimed(rdev, context, &error) == FALSE) {
 		dbus_g_method_return_error (context, error);
+		g_error_free (error);
 		return;
 	}

 	if (_fprint_device_check_polkit_for_action (rdev, context, "net.reactivated.fprint.device.enroll", &error) == FALSE) {
 		dbus_g_method_return_error (context, error);
+		g_error_free (error);
 		return;
 	}

@ -1140,6 +1157,7 @@ static void fprint_device_list_enrolled_fingers(FprintDevice *rdev,
 	if (_fprint_device_check_polkit_for_action (rdev, context, "net.reactivated.fprint.device.verify", &error) == FALSE) {
 		g_free (user);
 		dbus_g_method_return_error (context, error);
+		g_error_free (error);
 		return;
 	}

@ -1153,6 +1171,7 @@ static void fprint_device_list_enrolled_fingers(FprintDevice *rdev,
 		g_set_error(&error, FPRINT_ERROR, FPRINT_ERROR_NO_ENROLLED_PRINTS,
 			"Failed to discover prints");
 		dbus_g_method_return_error(context, error);
+		g_error_free (error);
 		return;
 	}

@ -1191,6 +1210,7 @@ static void fprint_device_delete_enrolled_fingers(FprintDevice *rdev,
 	if (_fprint_device_check_polkit_for_action (rdev, context, "net.reactivated.fprint.device.enroll", &error) == FALSE) {
 		g_free (user);
 		dbus_g_method_return_error (context, error);
+		g_error_free (error);
 		return;
 	}

--- a/src/file_storage.c
+++ b/src/file_storage.c
@ -41,10 +41,6 @@

 #define DIR_PERMS 0700

-#ifndef FILE_STORAGE_PATH
-#define FILE_STORAGE_PATH "/var/lib/fprint/"
-#endif
-
 #define FP_FINGER_IS_VALID(finger) \
 	((finger) >= LEFT_THUMB && (finger) <= RIGHT_LITTLE)

--- a/src/main.c
+++ b/src/main.c
@ -300,7 +300,10 @@ int main(int argc, char **argv)

 	context = g_option_context_new ("Fingerprint handler daemon");
 	g_option_context_add_main_entries (context, entries, GETTEXT_PACKAGE);
+
+#if !GLIB_CHECK_VERSION (2, 36, 0)
 	g_type_init();
+#endif

 	if (g_option_context_parse (context, &argc, &argv, &error) == FALSE) {
 		g_print ("couldn't parse command-line options: %s\n", error->message);
--- a/tests/delete.c
+++ b/tests/delete.c
@ -114,7 +114,10 @@ static void process_devices(char **argv)

 int main(int argc, char **argv)
 {
+#if !GLIB_CHECK_VERSION (2, 36, 0)
 	g_type_init();
+#endif
+
 	create_manager();

 	if (argc < 2) {
--- a/tests/enroll.c
+++ b/tests/enroll.c
@ -159,7 +159,9 @@ int main(int argc, char **argv)
 	GError *err = NULL;
 	DBusGProxy *dev;

+#if !GLIB_CHECK_VERSION (2, 36, 0)
 	g_type_init();
+#endif

 	dbus_g_object_register_marshaller (fprintd_marshal_VOID__STRING_BOOLEAN,
 					   G_TYPE_NONE, G_TYPE_STRING, G_TYPE_BOOLEAN, G_TYPE_INVALID);
--- a/tests/list.c
+++ b/tests/list.c
@ -130,7 +130,10 @@ static void process_devices(char **argv)

 int main(int argc, char **argv)
 {
+#if !GLIB_CHECK_VERSION (2, 36, 0)
 	g_type_init();
+#endif
+
 	create_manager();

 	if (argc < 2) {
--- a/tests/verify.c
+++ b/tests/verify.c
@ -172,7 +172,9 @@ int main(int argc, char **argv)
 	DBusGProxy *dev;
 	char *username;

+#if !GLIB_CHECK_VERSION (2, 36, 0)
 	g_type_init();
+#endif

 	dbus_g_object_register_marshaller (fprintd_marshal_VOID__STRING_BOOLEAN,
 					   G_TYPE_NONE, G_TYPE_STRING, G_TYPE_BOOLEAN, G_TYPE_INVALID);
Author	SHA1	Message	Date
Bastien Nocera	8eba309920	0.8.0	2017-09-13 16:27:53 +02:00
Bastien Nocera	6494efa94e	data: Stop privilege escalations in daemon Using the NoNewPrivileges stanza from systemd.	2017-09-13 15:48:17 +02:00
Christian Kellner	e55ad52ded	device: Fix warning when open the device fails The error should be initialised to NULL before being set.	2017-02-16 15:51:22 +01:00
Christian Kellner	0d28678118	device: dbus_g_method_return_error() does not free the error So free the errors after sending them on the bus. https://bugs.freedesktop.org/show_bug.cgi?id=99838	2017-02-16 15:44:12 +01:00
Christian Kellner	051eb0427d	pam: Don't poke the hardware if user has no registered prints Before claiming the device and therefore potentially activating the actual hardware, make a call to see if the user has any prints registered at all. https://bugs.freedesktop.org/show_bug.cgi?id=99811	2017-02-16 14:49:58 +01:00
Christian Kellner	f54a90ea80	pam: separate device opening and claiming For some operations, i.e. listing the enrolled prints, the device does not need to be claimed. Therefore the claiming can be delayed until we actually start the verification process, allowing us to query the fingerprint system if the user has any prints enrolled. https://bugs.freedesktop.org/show_bug.cgi?id=99811	2017-02-16 14:46:35 +01:00
Christian Kellner	da87d1d7ee	pam: Only call g_type_init when using an old glib Calling g_type_init() is not needed anymore and deprecated since glib version 2.36. https://bugs.freedesktop.org/show_bug.cgi?id=99812	2017-02-14 17:14:20 +01:00
Christian Kellner	3d2d73d615	main: call g_type_init only if using an old glib Calling g_type_init() is not needed anymore and deprecated since glib version 2.36. https://bugs.freedesktop.org/show_bug.cgi?id=99812	2017-02-14 17:14:20 +01:00
Christian Kellner	06ea385260	tests: call g_type_init only if using an old glib Calling g_type_init() is not needed anymore and deprecated since glib version 2.36. https://bugs.freedesktop.org/show_bug.cgi?id=99812	2017-02-14 17:14:20 +01:00
Christian Kellner	8fa3dcd5cd	main: Plug tiny memory leak dbus_g_method_get_sender() returns an allocated-string which we need to free. This is handled properly in the rest of the codebase. https://bugs.freedesktop.org/show_bug.cgi?id=99811	2017-02-14 14:29:54 +01:00
Bastien Nocera	32307570fe	po: Update translations	2017-02-11 18:17:40 +01:00
Piotr Drąg	7ae196a0dd	po: Remove duplicate Bulgarian and Persian translations https://bugs.freedesktop.org/show_bug.cgi?id=99773	2017-02-11 18:16:23 +01:00
Bastien Nocera	36d3d9d749	data: Lockdown the fprintd service Give read-write access to USB devices in /dev, and the location of the fingerprints, access to Unix sockets for D-Bus and close everything else down. See systemd.exec(5) for details about the options.	2017-01-05 13:04:48 +01:00
Bastien Nocera	b3c1ed0d2a	main: Don't hardcode fingerprint storage directory It used to be hard-coded to /var/lib/fprint, but is now set to $(localstatedir)/lib/fprint/.	2017-01-05 12:50:06 +01:00