T460s fingerprint reader in Linux
Lenovo ThinkPad T460s laptop has a built-in fingerprint reader, but unfortunately until recently there was no way to make it work. You know the story: the manufacturer (Validity, later bought by Synaptic) refuses to release the documentation and says they may release proprietary Linux driver someday. Thankfully, Nikita Mikhailov started reverse engineering these sensors and that work has been adapted by Marco Trevisan to create a functional fprint driver for 2016 ThinkPads (including T460s).
The procedure to make it work is not very straightforward, so I’ve decided to document it here for posterity.
First, let’s make sure we have the proper model of the reader:
$ lsusb | grep Fingerprint
Bus 001 Device 006: ID 138a:0090 Validity Sensors, Inc. VFS7500 Touch Fingerprint Sensor
Windows driver, eww
UPD: Looks like now you can initialize the reader directly in Linux!
The worst part of the procedure is to activate the device. Thus far this can only be done in Windows. If you have already used the reader before, chances are you’re good to go. If not, you’ll need a Windows Virtualbox instance with USB pass-through enabled and Extension pack installed. Then go to virtual machine settings | USB and add “Validity Sensors, Inc.” device to the list.
I’ve ran into trouble when trying to install official fingerprint reader drivers from Lenovo website. The installer would just quit with “Lenovo machines: Lenovo Touch Fingerprint Software cannot be installed on this machine. Setup will terminate now.” message. So I’ve downloaded a huge SCCM driver package, installed it and pointed Windows to look for drivers there. I’ve extracted only the fingerprint driver and put it here, give it a try if you use Windows 7 64-bit and don’t want to download the whole package. After a reboot, the drivers were successfully installed and it was sufficient to proceed.
Linux driver, yay
The rest is easy: just follow the Readme to install the Linux driver and make sure it works by enrolling a finger and verifying it:
$ fprintd-enroll -f "right-index-finger" "$USER"
$ fprintd-verify
You’ll be asked to enroll your finger several times. Try to cover all possible finger positions and don’t remove finger too quickly after each step.
Usage
I’m using home partition encryption, so I have to type in a password on every boot to decrypt the partition. If you don’t (which I recommend against by the way, especially on a laptop), adding this line on top of /etc/pam.d/sddm
should enable fingerprint authentication (if you use SDDM, of course):
auth sufficient pam_fprintd.so max-tries=3
What I do use fingerprint reader for is to unlock the screen. To enable this in KDE Plasma, add the same line to the top of /etc/pam.d/kde
.
Now if you lock your screen (e. g. with loginctl lock-session
command) you can press Return and touch the fingerprint sensor to unlock. The ugly part is that if you want to use the password, you’ll need the fingerprint scan to fail 3 times.
Finally, I’d like to thank the devs who made this terrific job and keep improving this and other drivers. Please consider supporting them if you like their work and please keep nagging the hardware manufacturers to release (preferably open) Linux drivers and documentation for their products. ๐
list_devices failed: No devices available
with: 138a:0097 Validity Sensor
Looks like 0097 is a special case: https://wiki.archlinux.org/index.php/Lenovo_ThinkPad_X1_Carbon_(Gen_5)#Fingerprint_Reader
Sorry about that ๐
This same thing happened to me, with: 138a:0090 Validity Sensor.
I tried a lot
you need a installation for windows 8.1 or higher
and the driver as published (means to remove the fingerprint) reinstall the new driver
reboot the virtualbox
and important as descriped in settings of the virtual mashine you need to aktivate than the fingerprinter as usb – that the vmware is able to acess
on linux
i startet the fingerprint-gui via
sudo QT_X11_NO_MITSHM=1 fingerprint-gui (take care it has a cause why usually you not start gui programms with root rights
voila it worked for me now
forgot to say thank you a lot for this blog / howto
It works like a charm, activated on Windows 10 under VirtualBox without downloading any driver, it looks like Windows 10 already has drivers for this fingerprint reader.
under Fedora, the compiling process has changed I had to use the following commands to compile from the sources and “install” the driver:
# cd /path/to/sources
# meson builddir & cd builddir
# ninja
# sudo cp libfprint/libfprint.so.0.0.0-thinkpad /usr/lib64
# sudo rm /usr/lib64/libfprint.so.0
# sudo ln -s /usr/lib64/libfprint.so.0.0.0-thinkpad /usr/lib64/libfprint.so.0
Then just open the Gnome Settings -> Details -> Users and configure the fingerprint like usual
Hey. Thank you very much it works like a charm!
I installed this driver on Windows 10 in Virtual Box 6 (I tried it in 5 but didn’t work):
https://download.lenovo.com/pccbbs/mobiles/n1cgn08w.exe
Thanks again!
Hi there, what do you mean by activating the sensor? I have an installation of windows on another ssd… could I do it from there? What should I do exactly…
or the Xubuntu should see the device from the virtual box?
thanks!
If you have Windows on the same machine it must be easier to activate the reader under it. Make sure the system sees the fingerprint reader and try swiping fingers there for a good measure. That must be it, the Linux driver must work.
Virtualbox procedure is for people who wiped Windows without activating the sensor (like myself).
It seems now there’s no need to use Windows for activation: https://github.com/3v1n0/libfprint/blob/vfs0090/README.md#device-initialization-and-pairing
Sad, when installing the “validity-sensors-tools” i get errors regarding missing AppArmor in the kernel, and other errors….
sudo snap install validity-sensors-tools
Error: cannot perform the following tasks:
– Set security profiles for snap “validity-sensors-tools” (65) (cannot setup profiles for snap “validity-sensors-tools”: cannot load apparmor profiles: exit status 1
apparmor_parser output:
Cache read / write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
Attention: No suitable file system could be found in >> / proc / mounts <<. Is it hooked?
Use –subdomainfs to override it.
)
Did you try Python version (https://github.com/3v1n0/python-validity) and manual install? I just tried AUR package and it compiled without problems.
I now tried with ubuntu 21.04 and it was possible to initialize the device and get the LED working. But when enrolling the finger i got a problem:
sudo validity-sensors-tools.enroll –finger-id 0
Found device
Opening device 0x90
Traceback (most recent call last):
File “/snap/validity-sensors-tools/65/vfs-tools/validity-sensors-tools.py”, line 380, in
vfs_tools.enroll(finger=args.finger_id)
File “/snap/validity-sensors-tools/65/vfs-tools/validity-sensors-tools.py”, line 270, in enroll
raise Exception(‘Enroll not supported yet for device {}’.format(
Exception: Enroll not supported yet for device 0x90
So somehow a step forward. May be I should spend some time more to investigate.
According to the readme, enrolling with validity-sensors-tools.enroll only works for 97 devices, not 90. Did you try to enroll with fprintd-enroll? Should work once the device is initialized.
I will try try again. by the way I meant ubuntu version 20.04. Regards dasfiete
Hi, know it is working, I followed this instruction https://github.com/3v1n0/libfprint for vfs0090 sensor and then I had to activate the fingerprint with “sudo pam-auth-update” and then activate the fingerprint login in the user menu, to register a fingerprint. Thanks a lot. Regards dasfiete
Good to hear! Let’s hope it survives many future updates! ๐
Hi, another2 stories of success. I bought a X1 Carbon 2nd gen with validity sensor 138a:0097. Then I installed ubuntu 22. 04 and used the uunicorm ppa for python validity, but I ran into the same mistake again, I had not activated the fingerprint with “sudo pam-auth-update” at first.
Later I decided to update my T460s to 22.04, and the fingerprint survived. Probably I will reinstall the system when I have the time to do this, but I am glad everything worked so far…
Regards dasfiete
I followed the instructions, and was able to initialize the reader on my t460s but when I go to enrol my prints I get:
$ fprintd-enroll -f “right-index-finger” “$USER”
Impossible to enroll: GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice: No devices available
Any Ideas why/ what to do next?
Thanks,
Brett
Hi! Is your fprintd service running? You can check with ‘systemctl status fprintd.service’.