Skip fingerprint auth when the laptop lid is closed (fprintd) on Fedora

When a laptop runs docked with the lid closed (external monitor, keyboard, mouse), the fingerprint reader is physically unreachable — but PAM does not know that. Every sudo, su, chroot-into-su or polkit prompt still offers fingerprint first, so you sit waiting on a sensor you cannot touch. This guide adds a lid check in front of pam_fprintd so PAM falls straight through to the password prompt when the lid is shut, and behaves exactly as before when it is open. It installs no daemon and reuses your existing fprintd-enrolled prints.

The ready-to-run scripts live in mylinuxtips/fingerprint/fprintd-skip-when-lid-closed; this is the long-form walkthrough.

Symptom

You are docked with the lid closed, and any authentication prompt hangs:

• sudo, su, polkit dialogs and the GNOME lock screen all wait on the fingerprint reader before offering a password.
• The reader is closed inside the docked laptop, so nothing you do satisfies it.
• Sometimes Ctrl-C drops you to the password prompt, sometimes it just kills the command.

There is no built-in fprintd option for “don’t offer fingerprint when the reader isn’t usable” — the upstream request (libfprint#403) has been open for years.

Root cause

pam_fprintd.so sits early in the PAM auth stack and unconditionally tries the reader. It has no awareness of lid state, dock state, or whether the sensor is reachable — so a closed-lid dock still gets the full fingerprint timeout before password auth is offered.

The laptop does know the lid is shut: the kernel exposes it at /proc/acpi/button/lid/*/state. The fix is to consult that at the moment of authentication and skip pam_fprintd when the lid is closed — no polling, no background service.

Diagnosis

Confirm the lid state is readable (most laptops expose it):

cat /proc/acpi/button/lid/*/state

It should print open or closed. Confirm fingerprint auth is fprintd-based and that PAM is authselect-managed (the Fedora default):

fprintd-list "$USER" | head -1          # enrolled prints exist
readlink -f /etc/pam.d/system-auth      # -> /etc/authselect/system-auth
grep -n pam_fprintd.so /etc/pam.d/system-auth /etc/pam.d/fingerprint-auth

If /etc/pam.d/system-auth resolves under /etc/authselect/ and the pam_fprintd.so lines are present, you are in the supported setup.

Solution

Prerequisites / warnings

• Fingerprint auth already working via fprintd (Fedora: authselect enable-feature with-fingerprint, prints enrolled with fprintd-enroll).
• pam_exec.so (ships with pam, at /usr/lib64/security/pam_exec.so).
• Editing PAM auth can lock you out. Before running the installer, open a second terminal and keep a root shell alive (sudo -i). If sudo misbehaves afterward, restore the backup files from that shell.

Steps

1. Fetch the scripts.

base=https://raw.githubusercontent.com/eloudsa/mylinuxtips/main/fingerprint/fprintd-skip-when-lid-closed
mkdir -p ~/fprintd-lid && cd ~/fprintd-lid
curl -fsSL -O "$base/install-lid-fprint.sh"
curl -fsSL -O "$base/status-lid-fprint.sh"

2. Run the installer.

sudo bash install-lid-fprint.sh

The installer:

1. Writes /usr/local/bin/fprint-lid-check.sh (root-owned, 0755) — a one-liner that exits failure when the lid is closed:

   grep -qw closed /proc/acpi/button/lid/*/state 2>/dev/null && exit 1
   exit 0

2. Backs up /etc/authselect/system-auth and /etc/authselect/fingerprint-auth to timestamped .bak-<stamp> files.

3. Inserts, idempotently, this line immediately before pam_fprintd.so in each file:

   auth        [success=ignore default=1]    pam_exec.so quiet /usr/local/bin/fprint-lid-check.sh

4. Sanity-checks that the line landed and password auth (pam_unix) is still present; if not, it auto-restores the backup and aborts.

system-auth covers sudo, su, chroot’s su, polkit and console login; fingerprint-auth covers the GNOME (GDM) fingerprint prompt, so the lock screen also goes straight to password when docked.

How the control word works — the [success=ignore default=1] guard turns the lid check into a conditional skip:

Verify

sudo -k clears the cached credential so you actually hit the auth stack:

# Lid CLOSED -> jumps straight to a password prompt, no fingerprint wait
sudo -k; sudo true

# Lid OPEN   -> offers fingerprint as before
sudo -k; sudo true

A no-root status check confirms the fix is in place (and is worth re-running after any GNOME fingerprint-toggle or pam/authselect update — see Notes):

bash status-lid-fprint.sh

fprintd lid-skip status
  [ok] helper           /usr/local/bin/fprint-lid-check.sh (executable)
  [ok] system-auth      lid-check before pam_fprintd (lines 8 < 9)
  [ok] fingerprint-auth lid-check before pam_fprintd (lines 7 < 8)
  lid state: closed

Result: INSTALLED — nothing to do.

It exits 0 when installed, 1 when anything is missing.

Notes and good practices

• authselect can wipe the edit. These PAM files are marked “Generated by authselect — user changes will be overwritten.” Toggling the fingerprint switch in GNOME Settings, or a pam/authselect update that re-renders them, removes the line. Run bash status-lid-fprint.sh any time to check; if it reports missing, just re-run sudo bash install-lid-fprint.sh — it’s idempotent. For a permanent setup, authselect opt-out (then manage PAM by hand) or bake the change into a custom authselect profile.
• Lid node name varies. Some machines use LID, others LID0; the glob /proc/acpi/button/lid/*/state handles both. If your laptop has no such node, the script exits 0 (fingerprint stays enabled) — swap the check for an external-display probe (e.g. /sys/class/drm/*/status reading connected).
• The reader still exists when docked — it’s just unreachable. This only changes when PAM offers it; it does not touch fprintd, libfprint or your enrolled prints.
• A daemon is the alternative. andypiper/fw-lid-fprint-daemon polls the lid and stops the fprintd service instead. The pam_exec approach here decides at authentication time, so it adds no latency and no service masking.
• Non-authselect distros (Debian/Ubuntu/Arch): the same idea works — add the auth [success=ignore default=1] pam_exec.so quiet /usr/local/bin/fprint-lid-check.sh line just before pam_fprintd.so in /etc/pam.d/common-auth (Debian) or the relevant /etc/pam.d/* file. Only the location and the pam_exec.so path differ (e.g. /usr/lib/x86_64-linux-gnu/security/).

Quick reference

# Install (Fedora / authselect)
base=https://raw.githubusercontent.com/eloudsa/mylinuxtips/main/fingerprint/fprintd-skip-when-lid-closed
curl -fsSL -O "$base/install-lid-fprint.sh"
sudo bash install-lid-fprint.sh

# Check it is still active (no root)
curl -fsSL -O "$base/status-lid-fprint.sh"
bash status-lid-fprint.sh

# Test
sudo -k; sudo true            # lid closed -> password prompt; lid open -> fingerprint

# Uninstall (restore the backups the installer reported)
sudo cp /etc/authselect/system-auth.bak-<stamp>      /etc/authselect/system-auth
sudo cp /etc/authselect/fingerprint-auth.bak-<stamp> /etc/authselect/fingerprint-auth
sudo rm /usr/local/bin/fprint-lid-check.sh

Source: https://github.com/eloudsa/mylinuxtips/tree/main/fingerprint/fprintd-skip-when-lid-closed