faceauth-rs

Linux-native face enrollment and authentication, designed for IR and visible light cameras with a Rust-first security boundary.

Status

This repository is an early security and architecture scaffold. It does not install a PAM module, change login configuration, or claim Windows Hello equivalence. Password fallback is mandatory.

The initial target hardware is a ThinkPad Z13 Gen 1 with:

• Chicony 04f2:b769 IR camera: 640x360 GREY at 15 fps;
• Chicony 04f2:b768 visible camera: 640x360 at 30 fps or higher;
• TPM 2.0 resource manager at /dev/tpmrm0;
• optional thinkpad-hpd presence hints over system D-Bus.

HPD can prewarm capture or improve desktop feedback. It is never accepted as identity or liveness evidence.

Intended architecture

• A privileged daemon owns cameras, inference, liveness, and encrypted templates.
• A small PAM module exchanges nonce-bound messages with the daemon.
• Enrollment requires existing authorization through Polkit or PAM.
• KDE System Settings provides a thin Security & Privacy → Face Authentication client over desktop-independent service APIs.
• Raw enrollment frames are ephemeral and are not retained by default.
• Face authentication never removes the password path.

See architecture, threat model, IPC boundary, model policy, template storage, camera capture, active liveness, enrollment, and presence integration, PAM boundary, and management contract, KDE experience, deployment artifacts, and production readiness, and research.

Development

cargo fmt --all --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace --all-features
cargo deny check
cargo audit

Read-only local diagnostics:

cargo run -p faceauth-daemon -- doctor --config /etc/faceauth/faceauth.json
cargo run -p faceauth-daemon -- capture-doctor --config ./cameras.json
cargo run -p faceauth-daemon -- presence-doctor
cargo run -p faceauth-cli -- policy

License

Licensed under either Apache-2.0 or MIT, at your option.