nixos/pam: Move pam_fprintd.so after pam_unix.so

[skeleten]

This enables logging into GUI applications using a password even when
using fprintd. However, this now requires first entering an empty
password before being prompted for a fingerprint.

Fixes #171136

Description of changes

This moves the checking of the pam_fprintd module after the pam_unix module. This is required for GUI applications to still be authenticated with a password

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 22.05 Release Notes (or backporting 21.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[SebTM]

I guess this should be an toggle option as it changes the current behavior without giving the possibility to switch back?

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/strange-lock-screen-behaviour-with-fprintd-enabled/10248/4

[RaitoBezarius]

Address current comments please.

[rht]

Bump. The formatting issue has been addressed. Still needs a rebase though.

However, this now requires first entering an empty
password before being prompted for a fingerprint.

I think the current behavior also requires you to press enter, which is equivalent to entering an empty password anyway.

[jtojnar]

I think the current behavior also requires you to press enter

At least in GDM and GNOME Shell polkit agent, you just put your finger on the fingerprint reader after being prompted, and it authenticates you without any further action.

[rht]

Ah, right, I forgot to mention that I'm using i3 & i3lock.

[RaitoBezarius]

I am on vacations so I cannot touch this yet, I recommend to rebase and look for other reviewers on Discourse.

[nyabinary]

Needs a rebase

[jtojnar]

However, this now requires first entering an empty
password before being prompted for a fingerprint.

This is a downgrade IMO.

Maybe something like #171136 (comment) would work better.

[nyabinary]

However, this now requires first entering an empty
password before being prompted for a fingerprint.

This is a downgrade IMO.

Maybe something like #171136 (comment) would work better.

I mean, no one made a config PR yet sadly...

[jtojnar]

I mean, no one made a config PR yet sadly...

That does not mean we should merge a broken PR instead.

And someone actually made a PR with what looked like a proper fix but there was still a bug and we lack people familiar with PAM to review it: #282322

Edit: Fixed in #321591

[AkechiShiro]

I think the current behavior also requires you to press enter

At least in GDM and GNOME Shell polkit agent, you just put your finger on the fingerprint reader after being prompted, and it authenticates you without any further action.

This may be related to sddm/sddm#1220 (comment)

[taciturnaxolotl]

would making an option in the fprint service to have password auth first be a better solution? it would be backwards compatible and still allow people to use the password first method without hacky workarounds