- Rust 64.2%
- QML 25%
- Shell 4.8%
- Makefile 2.1%
- HTML 1.3%
- Other 2.5%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
| .cargo-husky/hooks | ||
| .forgejo/workflows | ||
| .githooks | ||
| assets/icons | ||
| config | ||
| crates | ||
| docs | ||
| packaging | ||
| po | ||
| polkit | ||
| scripts | ||
| tools/ir-camera-trigger | ||
| ui | ||
| .envrc | ||
| .gitignore | ||
| .semgrepignore | ||
| Cargo.toml | ||
| CHANGELOG.md | ||
| CLAUDE.md | ||
| deny.toml | ||
| Dockerfile.ci | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| rust-toolchain.toml | ||
Linux Hello
Biometric authentication for Linux — a PAM-integrated authentication system inspired by Windows Hello, built in Rust.
Overview
linux-hello brings hardware-backed biometric authentication to Linux desktops and servers. It plugs into PAM as a standard authentication module, meaning it works transparently with any application that uses PAM: login managers (GDM, SDDM), sudo, polkit, screen lockers, and more.
Authentication is handled by a central system daemon that orchestrates one or more authenticators simultaneously. Each authenticator carries a trust score reflecting its resistance to spoofing; the daemon selects the strongest available factor at runtime and compares it against the minimum score required by the requesting service. If the preferred authenticator is unavailable (e.g. a FIDO2 key left at home), the system degrades gracefully to the next best enrolled option.
All sensitive data — biometric templates, encryption keys, configuration — is protected by TPM 2.0. Nothing leaves the device.
Supported Authenticators
| Authenticator | Trust Score | Notes |
|---|---|---|
| FIDO2 hardware key | 100 | Physical possession + PIN/biometric |
| Recovery token | 100 | One-time emergency bypass; argon2id-hashed |
| Fingerprint sensor | 70 | Via fprintd |
| TOTP | 60 | RFC 6238; any authenticator app |
| Webcam with IR | 50 | Depth-assisted liveness detection |
| PIN | 40 | Numeric PIN, TPM-bound |
| Webcam (RGB only) | 30 | Passive liveness detection |
Key Features
- PAM integration — drop-in module, no changes to existing PAM stacks required
- Trust score model — per-service minimum score, graceful fallback to best available factor
- Anti-spoofing — face recognition backed by ONNX liveness models; IR depth analysis when available
- TPM 2.0 storage — biometric templates and config sealed by hardware key, never stored in plaintext
- Display manager support — authentication is display-agnostic; optional UI overlay for GDM, SDDM, swaylock/hyprlock, and TTY
- Privacy-first — all inference runs locally; no network calls, no telemetry
Documentation
- User Manual — installation, PAM configuration, enrollment, trust policies, DM integration
- Architecture — full HLD: component map, IPC protocol, trust model flow, epic roadmap
Installation
linux-hello must be installed via a package manager — manual installation is not supported.
The PAM module (pam_linux_hello.so) is loaded by PAM at every login, sudo, and screen-unlock. An incorrect file path, wrong permissions, or a missing running service can lock you out of the system. Package manager installation guarantees correct placement, permissions, service activation, and clean removal.
Pre-built packages are available for:
| Distribution | Init | Package | Guide |
|---|---|---|---|
| Arch, CachyOS, Manjaro, EndeavourOS | systemd | .pkg.tar.zst |
install/arch.md |
| Artix Linux | OpenRC | .pkg.tar.zst |
install/artix-openrc.md |
| Artix Linux | runit | .pkg.tar.zst |
install/artix-runit.md |
| Debian 12+, Ubuntu 22.04+, Mint, Pop!_OS | systemd | .deb |
install/debian.md |
| Fedora 42+, Bazzite, RHEL 9+ | systemd | .rpm |
install/fedora.md |
| Void Linux | runit | .xbps |
install/void.md |
Download the latest release from the Releases page.
Status
Active development — core authentication pipeline, TOTP/recovery tokens, and packaging complete.
License
GNU General Public License v3.0 — see LICENSE.