Bug 1888181

For QA:

There are two categories where major changes happened upstream:
 1. Driver updates and a few required library adjustments in libfprint
 2. New DBus implementation in fprintd

Personally, I think all these changes are well executed. All of them have very good coverage with automated CI testing.

For 1., we are not testing most of them as they are for sensors that we are not really interested in. In my view, it is sufficient to test this for RHEL against the supported Synaptics device.

For 2., the major visible change is that you should be prompted for a password when enrolling a new print.

I was testing new pckgs and i am not able to log in gdm using fingerprint , also after using fingerprint in gdm  device is unavailable for a while  via terminal. In terminal  enroll , verify , delete works also enroll in gui works. Also i was testing current version of fprint and it is working.  Not sure if it is a feature or bug but after approximately 5 incorrect attempts to login  using finger i was not able to login with finger anymore in gdm.

Eeks, pretty sure you hit the one corner case that leads to inconsistencies and is not easily fixable.

There are multiple things coming together here:
 1. We don't do duplicate checking (on synaptics); this is fixable in fprintd, but not sure how complicated
 2. Synaptics started to support the "identify" operation, but that will incorrectly pick old prints
 3. fprintd-enroll permits you to just enroll a new print, without first deleting the old one. This leads to an old print being stored in the device.

Basically, this can only happen if you 1. use fprintd-enroll manually or 2. do a reinstall. The reinstall case is what worries me most here.

The "proper" fix would be to detect print duplication during enroll, and then auto-delete the print. We can do the following to improve the situation a bit though:

 1. Switch to "verify" if you only have one print (hiding the issue completely)
 2. Do not permit enrolling if a print is already stored for that finger (or implicitly delete it from the device).

The best way to fix it is to delete all prints and then run the below script (to delete everything still there from the device itself):

#!/usr/bin/env python3

import gi
gi.require_version('FPrint', '2.0')
from gi.repository import FPrint, GLib

ctx = GLib.main_context_default()

c = FPrint.Context()
c.enumerate()
devices = c.get_devices()

d = devices[0]
del devices

d.open_sync()

stored = d.list_prints_sync()

for p in stored:
    print("Deleting print: %s (%s)" % (p.props.description, p))
    d.delete_print_sync(p)

d.close_sync()

print("Done")

Well, the easiest short-term workaround would be disabling "identify" for synaptics in libfprint. Doing so means that you can only have on fingerprint enrolled per user.

The rebased packages were tested, the issues we discovered were are being tracked in https://bugzilla.redhat.com/show_bug.cgi?id=1907954 and we plan to fix them within 8.4.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (libfprint bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2021:1889