linux-face-unlock 1.0.0__py3-none-any.whl

face_unlock/__init__.py

@@ -0,0 +1 @@
+__version__ = "1.0.0"

face_unlock/authenticate.py

@@ -0,0 +1,363 @@
+from typing import Optional
+
+import fcntl
+import os
+import sys
+import time
+import syslog
+import cv2
+import numpy as np
+from . import config as cfgmod
+from . import camera as cam
+from . import face_engine as fe
+from . import storage as store
+from . import session as sessmod
+from . import dialog as dlgmod
+
+_RATE_LIMIT_DIR = "/etc/face-unlock/ratelimit"
+
+
+def _log(username, success, reason=""):
+    priority = syslog.LOG_AUTH | (syslog.LOG_INFO if success else syslog.LOG_WARNING)
+    msg = f"face-unlock[PAM]: user={username} {'granted' if success else 'denied'}"
+    if reason:
+        msg += f" ({reason})"
+    syslog.syslog(priority, msg)
+
+
+def _rate_lock_path(username):
+    return os.path.join(_RATE_LIMIT_DIR, username + ".lock")
+
+
+def _check_rate_limit(username, max_attempts=5, lockout_minutes=5):
+    try:
+        store.validate_username(username)
+    except ValueError:
+        return False
+    if max_attempts <= 0:
+        return True
+    now = time.time()
+    window = lockout_minutes * 60
+    fpath = os.path.join(_RATE_LIMIT_DIR, username)
+    lock_path = _rate_lock_path(username)
+    try:
+        lock_fd = os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o600)
+    except IOError:
+        return False
+    try:
+        fcntl.flock(lock_fd, fcntl.LOCK_EX)
+        try:
+            if not os.path.exists(fpath):
+                return True
+            try:
+                with open(fpath, "r") as f:
+                    timestamps = [float(line.strip()) for line in f if line.strip()]
+            except (IOError, ValueError):
+                return False
+            timestamps = [t for t in timestamps if now - t < window]
+            tmp = fpath + ".tmp"
+            try:
+                with open(tmp, "w") as f:
+                    for t in timestamps:
+                        f.write(f"{t}\n")
+                    f.flush()
+                    os.fsync(f.fileno())
+                os.rename(tmp, fpath)
+            except IOError:
+                return False
+            return len(timestamps) < max_attempts
+        finally:
+            fcntl.flock(lock_fd, fcntl.LOCK_UN)
+            os.close(lock_fd)
+    except Exception:
+        os.close(lock_fd)
+        return False
+
+
+def _record_failed_attempt(username):
+    try:
+        store.validate_username(username)
+    except ValueError:
+        return
+    d = _RATE_LIMIT_DIR
+    os.makedirs(d, mode=0o700, exist_ok=True)
+    fpath = os.path.join(d, username)
+    lock_path = _rate_lock_path(username)
+    try:
+        lock_fd = os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o600)
+    except IOError:
+        return
+    try:
+        fcntl.flock(lock_fd, fcntl.LOCK_EX)
+        try:
+            tmp = fpath + ".tmp"
+            try:
+                fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
+                with os.fdopen(fd, "a") as f:
+                    f.write(f"{time.time()}\n")
+                    f.flush()
+                    os.fsync(f.fileno())
+                os.rename(tmp, fpath)
+            except IOError:
+                pass
+        finally:
+            fcntl.flock(lock_fd, fcntl.LOCK_UN)
+            os.close(lock_fd)
+    except Exception:
+        os.close(lock_fd)
+
+
+def _clear_rate_limit(username):
+    try:
+        store.validate_username(username)
+    except ValueError:
+        return
+    fpath = os.path.join(_RATE_LIMIT_DIR, username)
+    try:
+        if os.path.exists(fpath):
+            os.remove(fpath)
+    except IOError:
+        pass
+
+
+def _try_retries(cap, encodings, retries, timeout, auto_timeout, tolerance,
+                  use_cnn, num_jitters):
+    for attempt in range(retries):
+        cap_timeout = auto_timeout if (attempt == 0 and auto_timeout > 0) else timeout
+        frame = cam.capture_frame(cap, timeout=cap_timeout)
+        if frame is None:
+            continue
+        encoding, _ = fe.encode_single_face(frame, use_cnn=use_cnn,
+                                             num_jitters=num_jitters)
+        if encoding is None:
+            continue
+        match, _ = fe.compare_encodings(encodings, encoding, tolerance=tolerance)
+        if match:
+            return True
+    return False
+
+
+def authenticate_user(username: str, device_path: Optional[str] = None, timeout: int = 5, retries: int = 3,
+                      tolerance: float = 0.55, use_cnn: bool = False, num_jitters: int = 5,
+                      require_blinks: int = 1) -> bool:
+    cfg = cfgmod.get_config()
+
+    max_attempts = cfgmod.get_max_attempts(cfg)
+    lockout_minutes = cfgmod.get_lockout_minutes(cfg)
+
+    if not _check_rate_limit(username, max_attempts, lockout_minutes):
+        _log(username, False, "rate limited")
+        return False
+
+    if not store.user_exists(username):
+        _log(username, False, "user not found")
+        return False
+
+    encodings = store.load_encodings(username)
+    if not encodings:
+        _log(username, False, "no encodings")
+        return False
+
+    if not device_path:
+        device_path = cfgmod.get_device_path(cfg)
+
+    cap = cam.open_camera(device_path)
+    if cap is None:
+        _log(username, False, "camera unavailable")
+        return False
+
+    time.sleep(0.3)
+
+    liveness_timeout = cfgmod.get_liveness_timeout(cfg)
+    auto_timeout = cfgmod.get_auto_capture_timeout(cfg)
+    show_dialog = cfgmod.get_show_auth_dialog(cfg)
+
+    winname = "Face Unlock - Look at the camera"
+    gui = cam.has_gui()
+    if gui:
+        cam.gui_named_window(winname, cv2.WINDOW_NORMAL)
+        cam.gui_resize_window(winname, 640, 480)
+
+    try:
+        liveness_ok = require_blinks <= 0
+        blink_count = 0
+        in_blink = False
+        liveness_start = time.time()
+
+        while not liveness_ok:
+            frame = cam.capture_frame(cap, timeout=0.5)
+            if frame is None:
+                if time.time() - liveness_start >= liveness_timeout:
+                    break
+                continue
+
+            ear, locations = fe.compute_ear(frame, use_cnn=use_cnn)
+            if ear is not None:
+                if ear < fe.EAR_THRESHOLD:
+                    if not in_blink:
+                        in_blink = True
+                else:
+                    if in_blink:
+                        blink_count += 1
+                        in_blink = False
+                        if blink_count >= require_blinks:
+                            liveness_ok = True
+
+            if gui:
+                display = frame.copy()
+                for (top, right, bottom, left) in locations:
+                    cv2.rectangle(display, (left, top), (right, bottom), (0, 255, 0), 2)
+                remaining = max(0, int(liveness_timeout - (time.time() - liveness_start)))
+                text = f"Blink: {blink_count}/{require_blinks}  Timeout: {remaining}s"
+                cv2.putText(display, text, (10, 30), cv2.FONT_HERSHEY_SIMPLEX, 0.7, (0, 255, 255), 2)
+                if ear is not None:
+                    cv2.putText(display, "Face detected", (10, 60), cv2.FONT_HERSHEY_SIMPLEX, 0.6, (0, 255, 0), 2)
+                else:
+                    cv2.putText(display, "No face detected", (10, 60), cv2.FONT_HERSHEY_SIMPLEX, 0.6, (0, 0, 255), 2)
+                cam.gui_imshow(winname, display)
+                if cam.gui_wait_key(1) == 27:
+                    cam.gui_destroy_all_windows()
+                    _log(username, False, "cancelled by user")
+                    return False
+
+            if time.time() - liveness_start >= liveness_timeout:
+                break
+
+        if not liveness_ok:
+            if gui:
+                display = np.zeros((480, 640, 3), dtype=np.uint8)
+                cv2.putText(display, "Liveness check failed", (100, 240),
+                            cv2.FONT_HERSHEY_SIMPLEX, 0.8, (0, 0, 255), 2)
+                cam.gui_imshow(winname, display)
+                cam.gui_wait_key(1000)
+                cam.gui_destroy_all_windows()
+            _log(username, False, "liveness check failed")
+            _record_failed_attempt(username)
+            return False
+
+        match_result = False
+        for attempt in range(retries):
+            cap_timeout = auto_timeout if (attempt == 0 and auto_timeout > 0) else timeout
+            frame = cam.capture_frame(cap, timeout=cap_timeout)
+            if frame is None:
+                if gui:
+                    display = np.zeros((480, 640, 3), dtype=np.uint8)
+                    cv2.putText(display, "Camera timeout", (150, 240),
+                                cv2.FONT_HERSHEY_SIMPLEX, 0.8, (0, 0, 255), 2)
+                    cam.gui_imshow(winname, display)
+                    cam.gui_wait_key(500)
+                continue
+
+            encoding, face_locations = fe.encode_single_face(frame, use_cnn=use_cnn,
+                                                              num_jitters=num_jitters)
+            if gui:
+                display = frame.copy()
+                if face_locations:
+                    for (top, right, bottom, left) in face_locations:
+                        cv2.rectangle(display, (left, top), (right, bottom), (0, 255, 0), 2)
+                if encoding is not None:
+                    text = f"Scanning... ({attempt+1}/{retries})"
+                    cv2.putText(display, text, (10, 30), cv2.FONT_HERSHEY_SIMPLEX, 0.7, (0, 255, 0), 2)
+                else:
+                    text = f"No face detected ({attempt+1}/{retries})"
+                    cv2.putText(display, text, (10, 30), cv2.FONT_HERSHEY_SIMPLEX, 0.7, (0, 0, 255), 2)
+                cam.gui_imshow(winname, display)
+                if cam.gui_wait_key(1) == 27:
+                    break
+
+            if encoding is not None:
+                match, _ = fe.compare_encodings(encodings, encoding, tolerance=tolerance)
+                if match:
+                    match_result = True
+                    if gui:
+                        display = frame.copy()
+                        cv2.putText(display, "Match! Access granted", (120, 240),
+                                    cv2.FONT_HERSHEY_SIMPLEX, 0.9, (0, 255, 0), 2)
+                        cam.gui_imshow(winname, display)
+                        cam.gui_wait_key(1500)
+                    break
+                if gui:
+                    display = frame.copy()
+                    cv2.putText(display, "No match, retrying...", (120, 240),
+                                cv2.FONT_HERSHEY_SIMPLEX, 0.7, (0, 0, 255), 2)
+                    cam.gui_imshow(winname, display)
+                    cam.gui_wait_key(500)
+
+        if gui:
+            cam.gui_destroy_all_windows()
+
+        if match_result:
+            _clear_rate_limit(username)
+            _log(username, True)
+            return True
+
+        if show_dialog:
+            session_info = sessmod.detect_session(username)
+            if session_info:
+                dlgmod.notify_failure(username, session_info)
+                choice = dlgmod.show_auth_choice(
+                    username, session_info,
+                    dialog_timeout=cfgmod.get_dialog_timeout(cfg),
+                )
+
+                if choice == "face" and _try_retries(cap, encodings, retries,
+                                                       timeout, auto_timeout, tolerance,
+                                                       use_cnn, num_jitters):
+                    _clear_rate_limit(username)
+                    _log(username, True)
+                    return True
+
+                if choice == "password":
+                    _log(username, False, "user chose password")
+                    return False
+
+        _log(username, False, "no match after all retries")
+        _record_failed_attempt(username)
+        return False
+    finally:
+        cam.release_camera(cap)
+
+
+def main():
+    username = os.environ.get("PAM_USER", "")
+    if not username:
+        if len(sys.argv) > 1:
+            username = sys.argv[1]
+        else:
+            sys.exit(1)
+
+    session_info = sessmod.detect_session(username)
+    if session_info:
+        for key in ("DISPLAY", "XAUTHORITY", "WAYLAND_DISPLAY", "XDG_RUNTIME_DIR"):
+            env_key = key
+            if key == "XAUTHORITY":
+                val = session_info.get("xauthority", "")
+            elif key == "WAYLAND_DISPLAY":
+                val = session_info.get("wayland_display", "")
+            elif key == "XDG_RUNTIME_DIR":
+                val = session_info.get("xdg_runtime_dir", "")
+            else:
+                val = session_info.get("display", "")
+            if val and env_key not in os.environ:
+                os.environ[env_key] = val
+
+    cfg = cfgmod.get_config()
+
+    if cfgmod.is_disabled(cfg):
+        sys.exit(1)
+
+    result = authenticate_user(
+        username=username,
+        timeout=cfgmod.get_timeout(cfg),
+        retries=cfgmod.get_retries(cfg),
+        tolerance=cfgmod.get_tolerance(cfg),
+        use_cnn=cfgmod.use_cnn(cfg),
+        num_jitters=cfgmod.get_num_jitters(cfg),
+        require_blinks=cfgmod.get_liveness_blinks(cfg),
+    )
+
+    sys.exit(0 if result else 1)
+
+
+if __name__ == "__main__":
+    main()

face_unlock/camera.py

@@ -0,0 +1,116 @@
+import os
+import time
+
+import cv2
+
+
+def detect_cameras():
+    devices = []
+    for i in range(10):
+        path = f"/dev/video{i}"
+        if os.path.exists(path):
+            devices.append(path)
+    return devices
+
+
+def open_camera(device_path=None, width=None, height=None):
+    from . import config as cfgmod
+
+    if width is None or height is None:
+        cfg = cfgmod.get_config()
+        if width is None:
+            width = cfgmod.get_frame_width(cfg)
+        if height is None:
+            height = cfgmod.get_frame_height(cfg)
+
+    if device_path:
+        try:
+            index = int(os.path.basename(device_path).replace("video", ""))
+        except (ValueError, IndexError):
+            index = 0
+        cap = cv2.VideoCapture(index)
+        if not cap.isOpened():
+            return None
+    else:
+        available = detect_cameras()
+        if not available:
+            return None
+        cap = None
+        for dev in available:
+            try:
+                idx = int(os.path.basename(dev).replace("video", ""))
+            except (ValueError, IndexError):
+                continue
+            cap = cv2.VideoCapture(idx)
+            if cap is not None and cap.isOpened():
+                break
+            cap = None
+        if cap is None:
+            return None
+
+    cap.set(cv2.CAP_PROP_FRAME_WIDTH, width)
+    cap.set(cv2.CAP_PROP_FRAME_HEIGHT, height)
+    cap.set(cv2.CAP_PROP_BUFFERSIZE, 1)
+
+    return cap
+
+
+def capture_frame(cap, timeout=5):
+    start = time.time()
+    while time.time() - start < timeout:
+        ret, frame = cap.read()
+        if ret and frame is not None and frame.size > 0:
+            return frame
+        time.sleep(0.1)
+    return None
+
+
+def release_camera(cap):
+    if cap is not None:
+        cap.release()
+
+
+def gui_named_window(winname, flags=cv2.WINDOW_NORMAL):
+    try:
+        cv2.namedWindow(winname, flags)
+    except cv2.error:
+        pass
+
+
+def gui_resize_window(winname, width, height):
+    try:
+        cv2.resizeWindow(winname, width, height)
+    except cv2.error:
+        pass
+
+
+def gui_imshow(winname, mat):
+    try:
+        cv2.imshow(winname, mat)
+    except cv2.error:
+        pass
+
+
+def gui_wait_key(delay=1):
+    try:
+        return cv2.waitKey(delay) & 0xFF
+    except cv2.error:
+        return 255
+
+
+def gui_destroy_all_windows():
+    try:
+        cv2.destroyAllWindows()
+    except cv2.error:
+        pass
+
+
+def has_gui():
+    if not os.environ.get("DISPLAY"):
+        return False
+    try:
+        cv2.namedWindow("__test", cv2.WINDOW_NORMAL)
+        cv2.destroyWindow("__test")
+        return True
+    except cv2.error:
+        return False

face_unlock/cli.py

@@ -0,0 +1,175 @@
+import argparse
+import os
+import subprocess
+import sys
+
+from . import config as cfgmod
+from . import storage as store
+from . import enroll
+from . import authenticate
+from . import test as testmod
+
+
+def cmd_enroll(args):
+    if os.geteuid() != 0:
+        print("ERROR: Must be root. Use sudo.", file=sys.stderr)
+        sys.exit(1)
+    success = enroll.enroll_user(
+        username=args.username,
+        device_path=args.device,
+        use_cnn=args.cnn,
+        num_jitters=args.jitters,
+        num_samples=args.samples,
+    )
+    sys.exit(0 if success else 1)
+
+
+def cmd_list(args):
+    users = store.list_users()
+    if not users:
+        print("No users enrolled.")
+        return
+    for u in users:
+        try:
+            count = store.encoding_count(u)
+            print(f"{u}: {count} encoding(s)")
+        except PermissionError:
+            print(f"{u}: (cannot read encodings, try sudo)")
+
+
+def cmd_remove(args):
+    if os.geteuid() != 0:
+        print("ERROR: Must be root. Use sudo.", file=sys.stderr)
+        sys.exit(1)
+    if not store.user_exists(args.username):
+        print(f"User '{args.username}' not found.")
+        return
+    store.remove_encodings(args.username)
+    print(f"Removed encodings for '{args.username}'.")
+
+
+def cmd_test(args):
+    testmod.test_all()
+    if args.user:
+        testmod.test_recognition(
+            args.user, args.device, args.cnn, timeout=args.timeout)
+
+
+def cmd_config(args):
+    cfg_path = cfgmod.CONFIG_PATH
+    if not os.path.exists(cfg_path):
+        print(f"Config file not found at {cfg_path}")
+        return
+    editor = os.environ.get("EDITOR", "vi")
+    try:
+        subprocess.run([editor, cfg_path])
+    except FileNotFoundError:
+        print(f"ERROR: Editor '{editor}' not found. Set EDITOR env var.", file=sys.stderr)
+        sys.exit(1)
+
+
+def cmd_enable(args):
+    if os.geteuid() != 0:
+        print("ERROR: Must be root. Use sudo.", file=sys.stderr)
+        sys.exit(1)
+    from . import pam
+    results = pam.enable_all()
+    for path, status in results.items():
+        print(f"  {path}: {status}")
+
+
+def cmd_disable(args):
+    if os.geteuid() != 0:
+        print("ERROR: Must be root. Use sudo.", file=sys.stderr)
+        sys.exit(1)
+    from . import pam
+    results = pam.disable_all()
+    for path, status in results.items():
+        print(f"  {path}: {status}")
+
+
+def cmd_default(args):
+    if os.geteuid() != 0:
+        print("ERROR: Must be root. Use sudo.", file=sys.stderr)
+        sys.exit(1)
+    from . import pam
+    mode = args.mode
+    if mode == "on":
+        results = pam.set_default_all("on")
+    elif mode == "off":
+        results = pam.set_default_all("off")
+    else:
+        print(f"ERROR: Invalid mode '{mode}'. Use 'on' or 'off'.", file=sys.stderr)
+        sys.exit(1)
+    for path, status in results.items():
+        print(f"  {path}: {status}")
+
+
+def cmd_status(args):
+    from . import pam
+    results = pam.status_all()
+    for path, info in results.items():
+        if not info["exists"]:
+            print(f"  {path}: not found")
+        elif not info["enabled"]:
+            print(f"  {path}: disabled")
+        else:
+            print(f"  {path}: enabled (default={info['default']})")
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Face-Unlock management CLI")
+    sub = parser.add_subparsers(dest="command")
+
+    p_enroll = sub.add_parser("enroll", help="Enroll a user")
+    p_enroll.add_argument("username", help="Username to enroll")
+    p_enroll.add_argument("--device", "-d", help="Camera device path")
+    p_enroll.add_argument("--cnn", action="store_true", help="Use CNN model")
+    p_enroll.add_argument("--samples", "-n", type=int, default=5)
+    p_enroll.add_argument("--jitters", "-j", type=int, default=5)
+
+    sub.add_parser("list", help="List enrolled users")
+
+    p_remove = sub.add_parser("remove", help="Remove a user's encodings")
+    p_remove.add_argument("username", help="Username to remove")
+
+    p_test = sub.add_parser("test", help="Test face unlock setup")
+    p_test.add_argument("--user", "-u", help="Test against enrolled user")
+    p_test.add_argument("--device", "-d", help="Camera device path")
+    p_test.add_argument("--cnn", action="store_true", help="Use CNN model")
+    p_test.add_argument("--timeout", "-t", type=int, default=10)
+
+    sub.add_parser("config", help="Edit configuration")
+
+    p_enable = sub.add_parser("enable", help="Enable face-unlock in PAM")
+    p_enable.set_defaults(func=cmd_enable)
+
+    p_disable = sub.add_parser("disable", help="Disable face-unlock in PAM")
+    p_disable.set_defaults(func=cmd_disable)
+
+    p_default = sub.add_parser("default", help="Set face-unlock as default auth")
+    p_default.add_argument("mode", choices=["on", "off"], help="on=face first, off=password first")
+    p_default.set_defaults(func=cmd_default)
+
+    sub.add_parser("status", help="Show face-unlock PAM status").set_defaults(func=cmd_status)
+
+    args = parser.parse_args()
+
+    if hasattr(args, "func"):
+        args.func(args)
+    elif args.command == "enroll":
+        cmd_enroll(args)
+    elif args.command == "list":
+        cmd_list(args)
+    elif args.command == "remove":
+        cmd_remove(args)
+    elif args.command == "test":
+        cmd_test(args)
+    elif args.command == "config":
+        cmd_config(args)
+    else:
+        parser.print_help()
+
+
+if __name__ == "__main__":
+    main()