fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintd.so" for Sudo. https://gitlab.freedesktop.org/libfprint/fprintd/-/releases https://lists.freedesktop.org/archives/fprint/2024-May/001231.html https://www.openwall.com/lists/oss-security/2024/05/30/3
Created fprintd tracking bugs for this issue: Affects: fedora-all [bug 2291439]
As I have said before, there is nothing that fprind can do about this. The reporter is asking for something that is impossible to implement/ensure for the fprintd stack. This is a fundamental problem with how PAM. The simple way to avoid it is to just not permit fingerprint authentication for "sudo" and on the console, but to only do it for PolicyKit and graphical login. There is *nothing* that fprintd can do about this.