PenguID

Face unlock for Omarchy · open source · GPL-3.0

PenguID

Look at your laptop and you're in. PenguID recognizes you with the infrared camera on the lock screen, at sudo and in polkit prompts, while your password stays the real key.

Get PenguID Why it's safe
  • Infrared camera
  • TPM-sealed face data
  • Face ID-style password rules
  • Nothing leaves the laptop
Looking · recognized

Everywhere you're asked

One penguin for every unlock

Face unlock is only useful if it is there when a prompt appears. PenguID covers the three places Omarchy asks who you are, and it shows you what it is doing each time.

Lock screen

Open the lid, look, done

A key, a click or opening the lid starts a scan, while the password field stays live the whole time. Three tries per wake, and none with the lid shut.

sudo and polkit

Press Enter for face

$ sudo pacman -Syu Press Enter for face, or type your password:

Press Enter and look at the camera, or type your password as always. Polkit prompts get their own PenguID dialog.

Face HUD

Shown above everything

Whenever face runs outside the lock screen, a small card with the penguin appears near the top of the screen, above every window and fullscreen app, like Face ID on an iPhone. It never takes a click.

It shows its work

You always know what the camera is doing

Ready Face unlock is on, and the camera is off.
Looking The infrared camera is on. The corners breathe.
Recognized A match. The penguin winks, and you're in.
Try again No match. Flat eyes, and your password is right there.

Secure by design

Convenient, without becoming the weakest lock

PenguID treats your face as a fast second way in, never a replacement for your password. Every part that touches authentication is small, local and open to read.

Your face stays on this laptop

irlume stores numbers derived from your face, never photos, encrypted with AES-256-GCM under a key sealed by the TPM. Nothing goes to a cloud, and nothing needs one.

It looks in infrared

The IR camera lights your face with its own emitter, and a trained anti-spoofing model checks for a live face. Photos held up on a phone screen were refused in testing.

Your password stays in charge

As on an iPhone, the first login after boot takes your password, which also opens your keyring. Face pauses after 48 hours without the password or after 5 refused faces, and a typed password works at every prompt, straight away.

Nothing scans until you ask

At sudo and polkit prompts the camera only starts when you press Enter. A stray sudo that nobody answers never turns it on, and with the lid shut it stays off.

It fails closed

If PenguID's rules check can't run, face is skipped and you simply get the password prompt. If it can't tell when you last typed your password, face waits for it. Unknown never means allowed.

Small parts, easy to audit

The PAM module behind the Enter prompt only checks whether your answer was empty, and never keeps or logs a password. The rules helper switches to your account before it touches a file, and polkit's sandbox stays on.

What it won't pretend

  • A 2D infrared camera can't measure depth the way Face ID's sensor does, so a realistic 3D mask is outside what it can stop.
  • Printed photos haven't been tested yet with irlume's IR-only mode, the setting PenguID was developed with.
  • Software already running as you could press Enter at a prompt, just as it could catch a typed password. A face proves you are there, not that you meant it.
  • An unlock takes about 3.6 seconds on the laptop PenguID was built on, most of it the IR camera settling.

How it works

Built on proven parts, joined with care

irlume does the recognition. PenguID decides when face may run, asks for your intent, and shows every step on screen.

Where you are
Lock screenOmarchy's lock screen with a face lane beside the password
sudoIn any terminal
Polkit dialogOmarchy's dialog, with the face lane
Face HUDThe penguin above every window
PenguID
Lid checkShut means no scan
Password rules48 hours, 5 refusals, fails closed
Your intentPress Enter for face
irlume
CaptureIR frames, its own emitter
LivenessIR checks and a trained model
MatchAgainst templates sealed by the TPM
Hardware
IR cameraThe Windows Hello kind
TPM 2.0Holds the key to your face data
#%PAM-1.0
# face-unlock: face via irlume (press Enter); the password still works. Undo: tools/privileged-pam.sh disable
auth       [success=4 default=ignore]  pam_exec.so quiet /usr/bin/omarchy-hw-laptop-closed
auth       [success=ignore ignore=ignore default=3]  pam_exec.so quiet stdout /usr/local/lib/penguid/pam-gate check
auth       [success=ignore default=2]  pam_penguid.so
auth       sufficient                  pam_irlume.so
auth       optional                    pam_penguid.so refused
auth       include                     system-auth
auth       optional                    pam_exec.so quiet /usr/local/lib/penguid/pam-gate record
account    optional                    pam_penguid.so
account    include                     system-auth
session    include                     system-auth
session    optional                    pam_systemd.so class=none
Everything PenguID adds to /etc/pam.d/sudo, highlighted. The password stack below it is untouched, and one command takes it all out again.

Get PenguID

Set up in a few minutes

  • Omarchy 4
  • An IR camera
  • TPM 2.0
  • irlume with your face enrolled

  1. Enroll your face in irlume

    PenguID uses irlume for recognition. Install it, then enroll:

    irlume enroll

  2. Add PenguID to Omarchy

    This installs the lock screen, the bar penguin and the face HUD.

    omarchy plugin add https://github.com/ReidenXerx/omarchy-penguid.git --enable

  3. Give the lock screen its face lane

    Create /etc/pam.d/omarchy-lock-face with:

    #%PAM-1.0
auth       sufficient                  pam_irlume.so
auth       required                    pam_deny.so
account    include                     system-local-login

  4. Turn on face for sudo and polkit

    Optional. Builds the Enter prompt, adds the password rules and wires both prompts:

    sudo ~/.config/omarchy/plugins/reidenxerx.penguid/tools/privileged-pam.sh enable

  5. Use PenguID's polkit dialog

    Optional. It replaces Omarchy's polkit dialog with one that knows about face:

    cp -r ~/.config/omarchy/plugins/reidenxerx.penguid/polkit ~/.config/omarchy/plugins/reidenxerx.penguid-polkit
omarchy-shell shell rescanPlugins
omarchy plugin enable reidenxerx.penguid-polkit

    Only one polkit agent can run per session, so stop any other one, such as hyprpolkitagent, first.

Changed your mind? omarchy plugin disable reidenxerx.penguid brings Omarchy's own lock screen back, and privileged-pam.sh disable takes face out of sudo and polkit.