Facelock 온디맨드 안면 인증 치트시트

sudo pacman -Syu acpid v4l-utils onnxruntime-cpu
# AUR에서 facelock 바이너리 패키지 설치
yay -S facelock-bin

# Facelock IR 카메라 고정 심볼릭 링크 규칙
# 듀얼 스트림 웹캠의 RGB(interface 00)와 IR(interface 02) 간 udev 경합 방지

# 외장 IR 카메라 (Interface 02)
SUBSYSTEM=="video4linux", KERNEL=="video*", ATTR{index}=="0", ENV{ID_VENDOR_ID}=="17ef", ENV{ID_MODEL_ID}=="4839", ENV{ID_USB_INTERFACE_NUM}=="02", SYMLINK+="v4l/by-id/lenovo-external-ir"

# 내장 IR 카메라 (Interface 02)
SUBSYSTEM=="video4linux", KERNEL=="video*", ATTR{index}=="0", ENV{ID_VENDOR_ID}=="3277", ENV{ID_MODEL_ID}=="0060", ENV{ID_USB_INTERFACE_NUM}=="02", SYMLINK+="v4l/by-id/shinetech-internal-ir"

[device]
path = "/dev/v4l/by-id/lenovo-external-ir"

[recognition]
execution_provider = "cpu"

[daemon]
mode = "daemon"
idle_timeout_secs = 60
camera_release_after_success_secs = 2

[security]
# 덮개가 닫힌 상태에서도 외장 IR 카메라 인증 허용
abort_if_lid_closed = false
abort_if_ssh = false
require_ir = true
bind_templates_to_device = true

[encryption]
method = "keyfile"

[notification]
mode = "terminal"
notify_on_failure = false

#!/usr/bin/env python3
"""리드 상태에 따라 적절한 IR 카메라를 선택하고 데몬 실행 시에만 설정을 갱신합니다."""
import fcntl
import glob
import os
from pathlib import Path
import re
import subprocess
import sys
import tempfile
import tomllib

EXTERNAL_CANDIDATES = [
    "/dev/v4l/by-id/lenovo-external-ir",
    "/dev/v4l/by-path/pci-0000:00:14.0-usb-0:1.4.2.1.3:1.2-video-index0",
]

INTERNAL_CANDIDATES = [
    "/dev/v4l/by-id/shinetech-internal-ir",
    "/dev/v4l/by-path/pci-0000:00:14.0-usb-0:9:1.2-video-index0",
]


def resolve_camera(candidates):
    for candidate in candidates:
        if Path(candidate).exists():
            return candidate
    return candidates[0]


def select_camera(closed):
    external = resolve_camera(EXTERNAL_CANDIDATES)
    internal = resolve_camera(INTERNAL_CANDIDATES)

    # 덮개 닫힘: 외장 IR 사용 / 덮개 열림: 내장 IR 우선
    preferred = external if closed else internal
    if Path(preferred).exists():
        return preferred
    if not closed and Path(external).exists():
        return external
    return preferred


def update_config(text, selected):
    pattern = r'(?ms)(^\[device\][^\n]*\n)(.*?)(?=^\[|\Z)'
    section = re.search(pattern, text)
    if not section:
        raise ValueError("Missing [device] section")
    body = section.group(2)
    setting = f'path = "{selected}"'
    if re.search(r"(?m)^path\s*=", body):
        body = re.sub(r"(?m)^path\s*=.*$", setting, body)
    else:
        body = setting + "\n" + body
    result = text[:section.start(2)] + body + text[section.end(2):]
    tomllib.loads(result)
    return result


def main():
    if os.geteuid() != 0:
        raise SystemExit("Run as root")

    closed = any("closed" in Path(p).read_text()
                 for p in glob.glob("/proc/acpi/button/lid/*/state"))

    path = Path("/etc/facelock/config.toml")
    with open("/run/facelock-camera.lock", "a") as lock:
        fcntl.flock(lock, fcntl.LOCK_EX)
        original = path.read_text()
        result = update_config(original, select_camera(closed))
        if result == original:
            return

        descriptor, temporary = tempfile.mkstemp(prefix=".camera-", dir=path.parent)
        try:
            with os.fdopen(descriptor, "w") as output:
                output.write(result)
                output.flush()
                os.fsync(output.fileno())
            os.chmod(temporary, 0o644)
            os.replace(temporary, path)
        finally:
            if os.path.exists(temporary):
                os.unlink(temporary)

        # 데몬이 현재 실행 중일 때만 재시작하여 온디맨드 유휴 상태 유지
        subprocess.run(["systemctl", "try-restart", "facelock-daemon.service"], check=False)


if __name__ == "__main__":
    main()

event=button/lid.*
action=/usr/local/bin/facelock-lid-switch

[Unit]
Description=Select Facelock IR camera before login
Before=greetd.service display-manager.service
After=systemd-udevd.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/facelock-lid-switch

[Install]
WantedBy=graphical.target

auth       sufficient   pam_facelock.so
auth       include      system-auth

auth       sufficient   pam_facelock.so
auth       include      system-local-login

# 1. Facelock 기본 설정 초기화 (CPU 프로바이더 및 키파일 암호화)
sudo facelock setup --non-interactive --no-pam --no-systemd --no-enroll \
  --models standard --execution-provider cpu --encryption keyfile

# 2. udev 규칙 적용 및 초기 카메라 선택
sudo install -m644 /etc/udev/rules.d/70-facelock-cameras.rules /etc/udev/rules.d/
sudo udevadm control --reload-rules && sudo udevadm trigger -s video4linux
sudo chmod 755 /usr/local/bin/facelock-lid-switch
sudo /usr/local/bin/facelock-lid-switch

# 3. 안면 데이터 등록 (외장 IR 카메라 기준)
sudo facelock enroll --user $USER --label external-ir
# 인증 확인 (정상 일치 시 종료 코드 0)
sudo facelock auth --user $USER

# 4. 기존 상주형 visaged 데몬 비활성화 및 마스킹 (메모리 누수 방지)
sudo systemctl disable --now visaged.service visage-resume.service
sudo systemctl mask visaged.service visage-resume.service

# 5. Facelock 온디맨드 데몬 및 부팅/ACPI 서비스 활성화
sudo systemctl unmask facelock-daemon.service
sudo systemctl daemon-reload
sudo systemctl enable --now acpid.service check-lid-on-boot.service

# PAM을 통한 sudo 인증 테스트 (카메라를 응시)
sudo -k && sudo /usr/bin/true

# 인증 직후 데몬 상태 확인: D-Bus 신호로 활성화되어 RSS ~400MB 점유 확인
systemctl status facelock-daemon.service

# 60초 경과 후 데몬 프로세스 자동 종료 및 메모리 반환 확인 (inactive 상태)
sleep 65
systemctl status facelock-daemon.service