fprintd-enroll does not require authentication or authorization to enroll new fingerprints

[setharnold]

Christopher Barrington-Leigh reports that fprintd-enroll does not prompt for authentication before adding new fingerprints to the database: https://bugs.launchpad.net/ubuntu/+source/fprintd/+bug/1532264

The most important part of the description from that bug is:

This means that anyone coming across or stealing a machine with it installed and which is currently logged in and for which fingerprints are enabled for sudo authentication can elevate their access to superuser by simply running fprintd-enroll and scanning their own fingers. A subsequent sudo command will then give the new user access.

Thanks

[fragmuffin]

👍. I just got root access to my laptop without a password with:

fprintd-enroll -f left-little-finger
# swipe any finger
sudo su
# swipe the same finger

then sudo apt remove fprintd for safety (for now)