T460s fingerprint reader in Linux

Lenovo ThinkPad T460s laptop has a built-in fingerprint reader, but unfortunately until recently there was no way to make it work. You know the story: the manufacturer (Validity, later bought by Synaptic) refuses to release the documentation and says they may release proprietary Linux driver someday. Thankfully, Nikita Mikhailov started reverse engineering these sensors and that work has been adapted by Marco Trevisan to create a functional fprint driver for 2016 ThinkPads (including T460s).
The procedure to make it work is not very straightforward, so I’ve decided to document it here for posterity.

First, let’s make sure we have the proper model of the reader:

$ lsusb | grep Fingerprint

Bus 001 Device 006: ID 138a:0090 Validity Sensors, Inc. VFS7500 Touch Fingerprint Sensor

Windows driver, eww

UPD: Looks like now you can initialize the reader directly in Linux!

The worst part of the procedure is to activate the device. Thus far this can only be done in Windows. If you have already used the reader before, chances are you’re good to go. If not, you’ll need a Windows Virtualbox instance with USB pass-through enabled and Extension pack installed. Then go to virtual machine settings | USB and add “Validity Sensors, Inc.” device to the list.

I’ve ran into trouble when trying to install official fingerprint reader drivers from Lenovo website. The installer would just quit with “Lenovo machines: Lenovo Touch Fingerprint Software cannot be installed on this machine. Setup will terminate now.” message. So I’ve downloaded a huge SCCM driver package, installed it and pointed Windows to look for drivers there. I’ve extracted only the fingerprint driver and put it here, give it a try if you use Windows 7 64-bit and don’t want to download the whole package. After a reboot, the drivers were successfully installed and it was sufficient to proceed.

Linux driver, yay

The rest is easy: just follow the Readme to install the Linux driver and make sure it works by enrolling a finger and verifying it:

$ fprintd-enroll -f "right-index-finger" "$USER"
$ fprintd-verify

You’ll be asked to enroll your finger several times. Try to cover all possible finger positions and don’t remove finger too quickly after each step.

Usage

I’m using home partition encryption, so I have to type in a password on every boot to decrypt the partition. If you don’t (which I recommend against by the way, especially on a laptop), adding this line on top of /etc/pam.d/sddm should enable fingerprint authentication (if you use SDDM, of course):

auth      sufficient pam_fprintd.so max-tries=3

What I do use fingerprint reader for is to unlock the screen. To enable this in KDE Plasma, add the same line to the top of /etc/pam.d/kde.
Now if you lock your screen (e. g. with loginctl lock-session command) you can press Return and touch the fingerprint sensor to unlock. The ugly part is that if you want to use the password, you’ll need the fingerprint scan to fail 3 times.

Finally, I’d like to thank the devs who made this terrific job and keep improving this and other drivers. Please consider supporting them if you like their work and please keep nagging the hardware manufacturers to release (preferably open) Linux drivers and documentation for their products. ๐Ÿ™‚

20 comments:

  1. Phill says:

    list_devices failed: No devices available
    with: 138a:0097 Validity Sensor

  2. christoph says:

    I tried a lot
    you need a installation for windows 8.1 or higher
    and the driver as published (means to remove the fingerprint) reinstall the new driver
    reboot the virtualbox
    and important as descriped in settings of the virtual mashine you need to aktivate than the fingerprinter as usb – that the vmware is able to acess

    on linux
    i startet the fingerprint-gui via
    sudo QT_X11_NO_MITSHM=1 fingerprint-gui (take care it has a cause why usually you not start gui programms with root rights
    voila it worked for me now

  3. christoph says:

    forgot to say thank you a lot for this blog / howto

  4. Gianluca says:

    It works like a charm, activated on Windows 10 under VirtualBox without downloading any driver, it looks like Windows 10 already has drivers for this fingerprint reader.

    under Fedora, the compiling process has changed I had to use the following commands to compile from the sources and “install” the driver:

    # cd /path/to/sources
    # meson builddir & cd builddir
    # ninja
    # sudo cp libfprint/libfprint.so.0.0.0-thinkpad /usr/lib64
    # sudo rm /usr/lib64/libfprint.so.0
    # sudo ln -s /usr/lib64/libfprint.so.0.0.0-thinkpad /usr/lib64/libfprint.so.0

    Then just open the Gnome Settings -> Details -> Users and configure the fingerprint like usual

  5. Adam Mazur says:

    Hey. Thank you very much it works like a charm!

    I installed this driver on Windows 10 in Virtual Box 6 (I tried it in 5 but didn’t work):
    https://download.lenovo.com/pccbbs/mobiles/n1cgn08w.exe

    Thanks again!

  6. Vlad says:

    Hi there, what do you mean by activating the sensor? I have an installation of windows on another ssd… could I do it from there? What should I do exactly…
    or the Xubuntu should see the device from the virtual box?

    thanks!

  7. dasfiete says:

    Sad, when installing the “validity-sensors-tools” i get errors regarding missing AppArmor in the kernel, and other errors….

    sudo snap install validity-sensors-tools
    Error: cannot perform the following tasks:
    – Set security profiles for snap “validity-sensors-tools” (65) (cannot setup profiles for snap “validity-sensors-tools”: cannot load apparmor profiles: exit status 1
    apparmor_parser output:
    Cache read / write disabled: interface file missing. (Kernel needs AppArmor 2.4 compatibility patch.)
    Attention: No suitable file system could be found in >> / proc / mounts <<. Is it hooked?
    Use –subdomainfs to override it.
    )

    • glsk says:

      Did you try Python version (https://github.com/3v1n0/python-validity) and manual install? I just tried AUR package and it compiled without problems.

      • dasfiete says:

        I now tried with ubuntu 21.04 and it was possible to initialize the device and get the LED working. But when enrolling the finger i got a problem:

        sudo validity-sensors-tools.enroll –finger-id 0
        Found device
        Opening device 0x90
        Traceback (most recent call last):
        File “/snap/validity-sensors-tools/65/vfs-tools/validity-sensors-tools.py”, line 380, in
        vfs_tools.enroll(finger=args.finger_id)
        File “/snap/validity-sensors-tools/65/vfs-tools/validity-sensors-tools.py”, line 270, in enroll
        raise Exception(‘Enroll not supported yet for device {}’.format(
        Exception: Enroll not supported yet for device 0x90

        So somehow a step forward. May be I should spend some time more to investigate.

        • glsk says:

          According to the readme, enrolling with validity-sensors-tools.enroll only works for 97 devices, not 90. Did you try to enroll with fprintd-enroll? Should work once the device is initialized.

          • dasfiete says:

            I will try try again. by the way I meant ubuntu version 20.04. Regards dasfiete

          • dasfiete says:

            Hi, know it is working, I followed this instruction https://github.com/3v1n0/libfprint for vfs0090 sensor and then I had to activate the fingerprint with “sudo pam-auth-update” and then activate the fingerprint login in the user menu, to register a fingerprint. Thanks a lot. Regards dasfiete

          • glsk says:

            Good to hear! Let’s hope it survives many future updates! ๐Ÿ™‚

          • dasfiete says:

            Hi, another2 stories of success. I bought a X1 Carbon 2nd gen with validity sensor 138a:0097. Then I installed ubuntu 22. 04 and used the uunicorm ppa for python validity, but I ran into the same mistake again, I had not activated the fingerprint with “sudo pam-auth-update” at first.
            Later I decided to update my T460s to 22.04, and the fingerprint survived. Probably I will reinstall the system when I have the time to do this, but I am glad everything worked so far…
            Regards dasfiete

  8. Brett Harris says:

    I followed the instructions, and was able to initialize the reader on my t460s but when I go to enrol my prints I get:
    $ fprintd-enroll -f “right-index-finger” “$USER”
    Impossible to enroll: GDBus.Error:net.reactivated.Fprint.Error.NoSuchDevice: No devices available
    Any Ideas why/ what to do next?
    Thanks,
    Brett

    • glsk says:

      Hi! Is your fprintd service running? You can check with ‘systemctl status fprintd.service’.

Your comment: