Merge pull request #64 from Vladush/feature/uac-style-prompt

feat: Interactive User Confirmation for Privilege Escalation

Author: Vladush

CHANGELOG.md

@@ -5,7 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.9.7.5] - 2026-06-10
+
+### Added
+
+- **Universal Confirmation & Password Fallback**: The PAM module now forces an interactive prompt (`<Enter>`) to neutralize silent privilege escalation for sensitive services (like `sudo`). Users can seamlessly bypass face authentication by typing their password at this prompt instead. Configurable via `require_confirmation` and `confirmation_exempt_services`.
+- **Proximity Wake Lock**: Added `always_wake_on_presence_detected` option to force wake on detection. Screen wake now requires presence detection in addition to confidence threshold.
+- **Background Worker**: Offloaded proximity sensor initialization to a background worker.
+
+### Fixed
+
+- **Memory Leaks**: Prevented memory leaks in subprocess execution by properly duplicating and freeing argument strings.
+- **Process Tracking**: Initialized pid variable to -1 to ensure safe process state tracking.
+- **Code Quality**: Applied C++17 best practices and resolved IDE and cppcheck warnings.
+- **Testing**: Added coverage for config parsing, camera device failures, and auth engine detection pipelines.
+
+### Docs
+
+- **Security**: Updated THREAT_MODEL_AND_RISK_ASSESSMENT for interactive confirmation, D-Bus screen-state synchronization, and automated wake/unlock vulnerabilities.
 
 ## [0.9.7.4] - 2026-06-02
 

CMakeLists.txt

@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.14)
-project(LinuxCamPAM VERSION 0.9.7.4 LANGUAGES C CXX)
+project(LinuxCamPAM VERSION 0.9.7.5 LANGUAGES C CXX)
 
 # --- Automatic Git Hook Installation ---
 # Installs/Updates the pre-push hook to prevent accidental pushes to master
@@ -129,6 +129,7 @@ add_library(service_core STATIC
     src/service/utils.cpp
     src/PresenceTripwire.cpp
     src/VirtualKeyboard.cpp
+    src/HardwareManager.cpp
 )
 target_include_directories(service_core PUBLIC include src src/common ${OpenCV_INCLUDE_DIRS})
 target_link_libraries(service_core PUBLIC 
@@ -143,7 +144,7 @@ if(nlohmann_json_FOUND)
 endif()
 
 # Auth Service
-add_executable(linuxcampamd src/service/main.cpp src/HardwareManager.cpp)
+add_executable(linuxcampamd src/service/main.cpp)
 target_link_libraries(linuxcampamd PRIVATE service_core)
 
 # CLI Tool
@@ -225,6 +226,11 @@ if(TARGET gtest)
         tests/test_pam_logic.cpp
         tests/test_config_parsing.cpp
         tests/test_camera.cpp
+        tests/test_hardware_manager.cpp
+        tests/test_presence_tripwire.cpp
+        tests/test_ite8353_parser.cpp
+        tests/test_sensor_factory.cpp
+        tests/test_scoped_worker.cpp
     )
 
     # The tests link against the service_core library to test internal logic without 

README.md

@@ -34,6 +34,7 @@ Since open-sourcing, I've put effort into making it hardware-agnostic and well-d
   - **Enhanced Enrollment**: HDR capture when supported, frame averaging for all cameras.
 - **Proximity Sensor Integration**: Native support for I2C HID human presence sensors (e.g., ITE8353) to detect human presence, optimize authentication, and reduce idle processing.
 - **Zero-Interaction Login**: Automatically wakes your displays and logs you in the moment you sit down, then automatically locks the OS when you walk away. (See [Threat Model](docs/THREAT_MODEL_AND_RISK_ASSESSMENT.md) for related security considerations, including walk-by unlocks and physical coercion).
+- **Universal Confirmation & Password Fallback**: Prevent silent privilege escalation via active user intent confirmation (`<Enter>`) for sensitive PAM actions like `sudo` or `su`, with an instant bypass for legacy passwords.
 - **Multi-Embedding Support**: Store multiple face embeddings per user for different lighting (`linuxcampam list`, `train --new`).
 - **PAM Integration**: Standard PAM module for Debian/Ubuntu.
 - **Security First**: [Threat Model & Risk Assessment](docs/THREAT_MODEL_AND_RISK_ASSESSMENT.md) included.
@@ -230,8 +231,8 @@ Shows the version of both the CLI client and the running daemon service.
 ```bash
 linuxcampam version
 # Output:
-# Client Version: 0.9.7.4+ga8f02f6
-# Daemon Version: 0.9.7.4+ga8f02f6
+# Client Version: 0.9.7.5+ga8f02f6
+# Daemon Version: 0.9.7.5+ga8f02f6
 ```
 
 ## Debugging

config/config.ini

@@ -58,6 +58,16 @@ detection_threshold = 0.9
 ; Default is 1000.
 ; min_uid = 1000
 
+; Require user confirmation (pressing Enter/Authenticate) before camera check for all non-exempt services.
+; This prevents silent privilege escalation (e.g., background sudo) by requiring explicit user intent.
+; Default is true.
+; require_confirmation = true
+
+; Comma-separated list of PAM services that are exempt from the confirmation prompt.
+; Typically, these are login managers and screen lockers where the user explicitly initiated the login process.
+; Default is "gdm-password,sddm,lightdm,login,swaylock,i3lock,xscreensaver,kscreenlocker,kde,systemd-user"
+; confirmation_exempt_services = "gdm-password,sddm,lightdm,login,swaylock,i3lock,xscreensaver,kscreenlocker,kde,systemd-user"
+
 ; Whether to show the welcome message upon successful authentication.
 ; Default is true.
 ; show_welcome = true

debian/changelog

@@ -1,3 +1,13 @@
+linuxcampam (0.9.7.5-1) unstable; urgency=medium
+
+  * Release 0.9.7.5
+  * Feat: Require interactive user confirmation for privilege escalation (UAC-style)
+  * Feat: Add proximity wake-lock and background worker for sensor initialization
+  * Fix: Prevent memory leaks in subprocess execution and ensure safe process tracking
+  * Docs: Update threat model and risk assessment for new features
+
+ -- Vladimir Orlinski <contact.github.submerge594@slmails.com>  Wed, 10 Jun 2026 22:17:20 +0200
+
 linuxcampam (0.9.7.4-1) unstable; urgency=medium
 
   * Release 0.9.7.4

docs/CONFIGURATION.md

@@ -159,10 +159,14 @@ Protect against brute-force attacks by limiting the number of consecutive failur
 [Security]
 lockout_attempts = 5
 lockout_duration_sec = 300
+require_confirmation = true
+confirmation_exempt_services = gdm-password, swaylock, login, kdm, lightdm, sddm
 ```
 
 - **lockout_attempts**: Number of failed attempts before temporary lockout.
 - **lockout_duration_sec**: Duration of lockout in seconds (default 300s = 5 minutes).
+- **require_confirmation**: If `true` (default), blocks silent privilege escalation by requiring you to press `<Enter>` to invoke the camera, or type a password to seamlessly bypass face authentication altogether.
+- **confirmation_exempt_services**: A comma-separated list of PAM services that bypass the confirmation prompt. These are typically explicit login events where the camera should activate instantly to avoid user fatigue.
 
 ### Advanced Configuration Security
 

docs/THREAT_MODEL_AND_RISK_ASSESSMENT.md

@@ -112,6 +112,15 @@ We use the STRIDE framework to analyze potential threats to the authentication p
 * **Threat 3 (Amplified Spoofing Window):** Automated wake and unlock constantly polls when presence is detected. An attacker can repeatedly present high-resolution masks or photos at their leisure while the user is away, increasing the window for brute-forcing the neural network.
 * **Mitigation:** This is actively mitigated by the daemon's existing brute-force protection (per-user lockout mechanism). After a configurable number of failed recognition attempts, the system enforces a strict cooldown period, neutralizing rapid spoofing attempts. Furthermore, IR liveness checks severely degrade the success rate of presentation attacks.
 
+### 3.9 Silent Privilege Escalation (Confused Deputy)
+
+* **Threat:** A malicious background script attempts to silently escalate privileges via `pkexec` or `sudo`. If the authorized user happens to be sitting in front of the computer, the camera passively authenticates the request without the user's knowledge or active intent, inadvertently granting `root` access to the malware.
+* **Mitigation:**
+  * **Universal Confirmation:** The `require_confirmation` configuration (enabled by default) forces the PAM module to display an interactive prompt requiring the user to physically press `<Enter>` to confirm their intent *before* engaging the camera. This actively neutralizes silent escalation attacks for all non-exempt PAM services.
+  * **Seamless Password Bypass:** The confirmation prompt now captures keystrokes (`"Press <Enter> for face auth, or type password:"`). If a user inputs a password, the module immediately aborts face authentication and passes the password securely (`PAM_AUTHTOK`) to the next module in the PAM stack (e.g., `pam_unix.so`). This avoids double-prompting while providing an instant opt-out for environments where users temporarily prefer passwords.
+  * **Service Exemptions:** To prevent user fatigue, explicitly intentional authentication services (e.g., login managers like `gdm-password`, screen lockers like `swaylock`) are exempted from this confirmation prompt via the `confirmation_exempt_services` list.
+* **Residual Risk:** Fully mitigated by default. Administrators who manually add `sudo` or `polkit-1` to the exemption list actively assume this risk.
+
 ## 4. Risk Assessment Matrix
 
 ### 4.1 Methodology
@@ -145,6 +154,7 @@ Overall Risk is calculated by combining **Likelihood** (Low, Medium, High) and *
 | **Zero-Interaction** | Physical Coercion (Forced Unlock) | Low | Critical | **Medium** | Accepted Risk | Inherent to all biometrics (including fingerprints). Falls under organizational Risk Appetite; if unacceptable, disable LinuxCamPAM entirely. |
 | **Zero-Interaction** | Unintended Unlock (Walk-By after Lock) | Medium | High | **High** | No | User explicitly locks but remains in FOV. Disable zero-interaction unlock if at risk. |
 | **Zero-Interaction** | Amplified Spoofing Window | Medium | High | **Medium** | Yes | Polling increases attack window, but is effectively neutralized by existing auth lockouts and IR liveness checks. |
+| **Zero-Interaction** | Silent Privilege Escalation | Medium | Critical | **High** | Yes | `require_confirmation` blocks all unexpected services. Does not apply to exempt login managers. |
 
 ## 5. Future Security Enhancements (Roadmap)
 

docs/man/linuxcampam.1.md

@@ -2,7 +2,7 @@
 title: LINUXCAMPAM
 section: 1
 header: LinuxCamPAM User Manual
-footer: LinuxCamPAM 0.9.7.4
+footer: LinuxCamPAM 0.9.7.5
 date: June 2026
 ---
 

docs/man/linuxcampam.conf.5.md

@@ -2,7 +2,7 @@
 title: LINUXCAMPAM.CONF
 section: 5
 header: LinuxCamPAM Configuration File
-footer: LinuxCamPAM 0.9.7.4
+footer: LinuxCamPAM 0.9.7.5
 date: June 2026
 ---
 

docs/man/linuxcampamd.8.md

@@ -2,7 +2,7 @@
 title: LINUXCAMPAMD
 section: 8
 header: LinuxCamPAM System Manager's Manual
-footer: LinuxCamPAM 0.9.7.4
+footer: LinuxCamPAM 0.9.7.5
 date: June 2026
 ---