DEV Community

Kalle Tolonen
Kalle Tolonen

Posted on Originally published at kalletolonen.com

Fixing the VFS5011 fingerprint reader on Omarchy

#linux #omarchy #fingerprint

My laptop has a Validity VFS5011 fingerprint reader and I wanted fingerprint auth on Omarchy. Enrolling worked fine. The verify right after it didn't, and the Omarchy setup script took that as a hard fail and never wrote the PAM config, even though my print was already enrolled. Turns out the reader just wedges after enrollment. A USB reset fixes it.

The symptom

Enrollment goes through, and the verification fails with this:

failed to claim device: GDBus.Error:net.reactivated.Fprint.Error.Internal: Open failed with error: transfer failed
Enter fullscreen mode Exit fullscreen mode

omarchy-setup-security-fingerprint reads that as a failed setup and bails before touching PAM. So you end up with an enrolled print that is not used.

Problem is im the chipset: Validity Sensors VFS 5011, USB id 138a:0017. It's tracked in omarchy#10091.

Why it happens

The VFS5011 gets stuck after enrollment. Reset the USB device and verify results.

Reset the reader 

sudo systemctl stop fprintd
sudo usbreset 138a:0017
sleep 2
sudo systemctl start fprintd
Enter fullscreen mode Exit fullscreen mode

Verification

Your print is already there, so test before you redo anything:

fprintd-verify
Enter fullscreen mode Exit fullscreen mode

You want to see verify-match. Enroll again only if verify still fails after a reset.

Step 3: Finish the PAM config

Same config omarchy-setup-security-fingerprint would have written.

For sudo and polkit, add these to /etc/pam.d/sudo and /etc/pam.d/polkit-1. The first line skips fingerprint when the lid is closed, the second enables it:

auth      [success=1 default=ignore] pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed
auth      sufficient pam_fprintd.so
Enter fullscreen mode Exit fullscreen mode

For the lock screen, create /etc/pam.d/omarchy-lock-fingerprint:

#%PAM-1.0
auth       required                    pam_fprintd.so
account    include                     system-local-login
Enter fullscreen mode Exit fullscreen mode

Or, if your Omarchy is new enough to retry verify on its own, just rerun the setup after the reset:

omarchy-setup-security-fingerprint
Enter fullscreen mode Exit fullscreen mode

Step 4: Confirm it works 

sudo -k
sudo -v
Enter fullscreen mode Exit fullscreen mode

That should ask for your finger. Same for polkit prompts and the lock screen (Super + Ctrl + L).

Notes

  • Enrollment is fine. Only the claim right after it fails.
  • If you have this same reader, the reset trick should apply to you too, not just on Omarchy.
  • Fix was ofc done with agents, as Omarchy is agent native

Top comments (0)