Setting up biometric face authentication on Fedora Linux using Biopass can feel like a dream—until it works perfectly for your sudo terminal commands but completely drops the ball on your graphical lock screen or applications like 1Password.
When this happens, it isn’t a random glitch. It is the result of security boundaries colliding: Fedora’s strict SELinux policies, PAM (Pluggable Authentication Modules) execution contexts, and application-specific configurations.
Here is an in-depth, step-by-step breakdown of how these systems interact, why they block face unlock, and exactly how to fix them.
The Core Architecture: Why Face Unlock Breaks
To fix the pipeline, you have to understand the three distinct layers handling your authentication.
PAM (The Gatekeeper): Dictates how you can log in. When an app requests your identity, PAM runs down a list of modules (like libbiopass_pam.so or pam_unix.so) to verify you.
The Execution Context: sudo runs directly inside your active user session with root privileges. Desktop lock screens (gdm or sddm) and background credential managers run as isolated background processes (xdm_t or polkitd).
SELinux (The Guard Dog): Fedora’s default security engine enforces strict confinement. Even if PAM tells a background process to use the camera, SELinux will silently block it if that process doesn’t have explicit permission to access video devices (v4l_device_t).
Fixing the Screen Lock (The SELinux Layer)
If your terminal handles face unlock but your lock screen skips it entirely or freezes, SELinux is actively blocking the display manager from touching your webcam.
Step 1: Catch the Silent Blocks
When the lock screen attempts to use Biopass and fails, SELinux logs an Access Vector Cache (AVC) denial. You can extract these specific blocks right after a failed login attempt:
sudo ausearch -m AVC,USER_AVC -ts recentLook for lines containing comm="biopass-helper", path="/dev/video0", and scontext=system_u:system_r:xdm_t. This confirms that the display manager (xdm_t) was denied access to your video hardware.
Step 2: Build a Custom SELinux Policy
Do not disable SELinux or set it to permissive mode. Instead, generate a targeted policy module that allows the lock screen context to map your camera:
sudo ausearch -m AVC,USER_AVC -ts recent | audit2allow -M my-biopass-camThis creates two files in your working directory:
my-biopass-cam.te: A type enforcement text file detailing the permission.
my-biopass-cam.pp: The compiled policy package.
Step 3: Inject the Module
Load the compiled package permanently into Fedora’s active kernel configuration:
sudo semodule -i my-biopass-cam.ppNote on Persistence: Once injected via semodule, the rule is written directly into Fedora’s permanent SELinux policy store. It is completely permanent and will survive system reboots, upgrades, and kernel updates. You can safely clean up your directory afterwards:
rm my-biopass-cam.te my-biopass-cam.ppFixing 1Password & Desktop Apps (The Service Layer)
Apps like 1Password rely on Polkit (PolicyKit) to manage graphical privileges, or read system authentication rules directly via PAM.
If your screen lock works but 1Password still drops straight to a typed password box without turning on the camera, the restriction is usually inside the application configuration or Biopass itself.
Step 1: The Hidden “Ignore” List
Many biometric helpers ship with default configurations designed to ignore certain system applications to prevent stability issues or infinite credential loops.
If Biopass is explicitly told to ignore Polkit or application-specific authentication requests, it will silently fail before it ever passes an error to the logs.
- Open your Biopass core configuration utility or configuration file.
- Locate the Ignore List / Ignored PAM Services section.
- Remove entries like
polkit-1or app-specific strings (e.g.,1password).
- Save the configuration and restart the background daemon.
Step 2: Addressing Flatpak Sandboxing
If your application still refuses to trigger the camera, verify how the app was installed.
flatpak list | grep -i 1passwordIf you installed the application via Fedora Software as a Flatpak, it is running inside a strict, isolated container. Flatpaks are physically barred from reading host PAM modules (/etc/pam.d/) and interacting directly with system-level biometrics.
The Fix: Uninstall the Flatpak version, add the official repository, and install the native .rpm version of the application instead.
Step 3: Create the Application PAM Rule
For native applications, ensure they know how to call the biometric library by giving them a dedicated entry point in the PAM directory:
sudo nano /etc/pam.d/1passwordPaste the following explicit stack:
#%PAM-1.0
auth sufficient libbiopass_pam.so
auth include system-auth
account include system-auth
password include system-auth
session include system-authForce-quit the application process to flush its memory:
1password --quitWhen reopened, the application bypasses system-level fallbacks and targets the camera library cleanly.
Reverting Temporary Workarounds
During deep-dive troubleshooting, you might have modified system users or group permissions—such as adding background service accounts to the hardware group:
sudo usermod -aG video polkitdBecause your fix involved removing the service constraints from the Biopass ignore list, keeping system daemons in the hardware group creates an unnecessary security surface. Clean it up using gpasswd:
sudo gpasswd -d polkitd videoVerify the user context is cleanly separated:
groups polkitd(Output should only show polkitd : polkitd)
Finally, restart your authorization manager to cycle the environment changes safely:
sudo systemctl restart polkitSummary Troubleshooting Checklist
If your face unlock stops working at any stage on Fedora, follow this triage flow:
| Symptom | Root Cause | Fix |
| Works in terminal, fails on lock screen | SELinux context restriction (xdm_t) | Generate policy with audit2allow and inject via semodule. |
| Fails silently on Polkit/App prompt | Module ignore filter or sandbox block | Remove the app service from the Biopass ignore list; use native .rpm over Flatpaks. |
| Falls back to password box immediately | PAM stack order misconfiguration | Ensure auth sufficient libbiopass_pam.so is at the very top of the target file. |