fingerprint reader `04f3:0c77` ELAN:ARM-M4 on Arch-based distros

04f30c77.md

fingerprint reader in asus expertbook b5 flip (Cachy OS, KDE)

---

Working solution for 04f3:0c77 ELAN:ARM-M4 on Arch-based distros

Device: 04f3:0c77 Elan Microelectronics ELAN:ARM-M4 Tested on: CachyOS (Arch-based), March 2026 Package used: libfprint-elanmoc2-working-git (AUR)

---

Step 1 — Confirm your device is visible:

lsusb | grep -i elan
# Expected output:
# Bus 00X Device 00X: ID 04f3:0c77 Elan Microelectronics Corp. ELAN:ARM-M4

Step 2 — Clone the AUR package and extract sources only:

sudo pacman -S glib2-devel   # critical — missing dep not listed in AUR
git clone https://aur.archlinux.org/libfprint-elanmoc2-working-git.git
cd libfprint-elanmoc2-working-git
makepkg --nobuild --syncdeps

--nobuild downloads and extracts sources without compiling. --syncdeps installs missing build dependencies automatically.

Step 3 — Find the files to patch:

find src/ -name "elanmoc2.h"
# Output: src/libfprint/libfprint/drivers/elanmoc2/elanmoc2.h

find src/ -name "autosuspend.hwdb"
# Output: src/libfprint/data/autosuspend.hwdb

Step 4 — Patch elanmoc2.h:

Open the file in a text editor:

kate src/libfprint/libfprint/drivers/elanmoc2/elanmoc2.h
# or: nano, gedit, vim — any editor works

Find the ID table (search for elanmoc2_id_table) and add the 0x0c77 line:

static const FpIdEntry elanmoc2_id_table[] = {
  {.vid = ELANMOC2_VEND_ID, .pid = 0x0c00, .driver_data = ELANMOC2_ALL_DEV},
  {.vid = ELANMOC2_VEND_ID, .pid = 0x0c4c, .driver_data = ELANMOC2_ALL_DEV},
  {.vid = ELANMOC2_VEND_ID, .pid = 0x0c5e, .driver_data = ELANMOC2_DEV_0C5E},
  {.vid = ELANMOC2_VEND_ID, .pid = 0x0c77, .driver_data = ELANMOC2_ALL_DEV},  // ← add this line
  {.vid = 0, .pid = 0, .driver_data = ELANMOC2_DEV_0C4C}
};

Make sure indentation and the comma at the end match exactly with the lines above.

Save and close.

Step 5 — Patch autosuspend.hwdb:

Open the file:

kate src/libfprint/data/autosuspend.hwdb

Find the elanmoc2 block (search for elanmoc2) and add usb:v04F3p0C77*:

# Supported by libfprint driver elanmoc2
usb:v04F3p0C00*
usb:v04F3p0C4C*
usb:v04F3p0C5E*
usb:v04F3p0C77*     ← add this line
 ID_AUTOSUSPEND=1
 ID_PERSIST=0

Then scroll to the bottom of the file and find the "Known unsupported devices" block. Delete the usb:v04F3p0C77* line from there:

# Known unsupported devices
...
usb:v04F3p0C77*     ← delete this line
...

Save and close.

Step 6 — Delete stale build cache (CRITICAL):

rm -rf src/build

This is the most common mistake. If you skip this, meson reuses the old compiled output and your edits are silently ignored even though they're in the source files.

Step 7 — Build and install without re-extracting sources:

makepkg --noextract -si -f

--noextract tells makepkg to use the already-extracted src/ directory as-is, preserving your edits. Without this flag, sources get re-extracted and your patches get wiped.

Step 8 — Update hwdb rules:

sudo systemd-hwdb update
sudo udevadm control --reload-rules
sudo udevadm trigger

Step 9 — Install fprintd:

sudo pacman -S fprintd
sudo systemctl start fprintd

libfprint (the driver library you just built) and fprintd (the daemon that exposes fingerprint auth to the system) are two separate packages. You need both.

Step 10 — Verify the device is detected:

fprintd-list $USER
# Expected output:
# found 1 devices
# Device at /net/reactivated/Fprint/Device/0
# User <yourname> has no fingers enrolled for ELAN Match-on-Chip 2.

If it says "No devices available", run fprintd in debug mode to diagnose:

sudo systemctl stop fprintd
sudo LIBFPRINT_DEBUG=1 G_MESSAGES_DEBUG=all /usr/lib/fprintd 2>&1 | head -30

You should see a line like:

libfprint-elanmoc2-DEBUG: ../libfprint/libfprint/drivers/elanmoc2/elanmoc2.c:1073

That confirms the elanmoc2 driver claimed your device. If you instead see:

No driver found for USB device 04F3:0C77

Then the patch didn't make it into the binary — make sure you deleted src/build/ in Step 6 before rebuilding.

Step 11 — Enroll your fingerprint:

fprintd-enroll $USER
# Scan your finger 9 times as prompted

If the CLI hangs at the final step, enroll via GUI instead: KDE Settings → Users → Fingerprint Login

---

Common gotchas:

• Never run makepkg -si directly after patching — always use makepkg --noextract -si -f or sources get re-extracted and your edits are lost
• Always delete src/build/ before rebuilding or meson reuses the stale cached binary
• fprintd and libfprint are separate packages — you need both installed
• pam-auth-update doesn't exist on Arch — edit PAM files manually as shown above
• fprintd uses D-Bus activation so systemctl enable will give a warning — just use systemctl start instead

PAM section

---

Enabling fingerprint for sudo, login and GUI authentication (Arch-based systems)

Note: pam-auth-update does not exist on Arch-based systems. PAM files must be edited manually.

---

For sudo (terminal):

sudo nano /etc/pam.d/sudo

Add after #%PAM-1.0:

auth sufficient pam_fprintd.so

---

For login screen:

sudo nano /etc/pam.d/system-local-login

Add after #%PAM-1.0:

auth sufficient pam_fprintd.so

---

For GUI authentication popups (Polkit — e.g. mounting drives, package managers):

On Arch/CachyOS, polkit's PAM file lives in /usr/lib/pam.d/ instead of /etc/pam.d/. Do not edit /usr/lib/pam.d/polkit-1 directly — it will be overwritten on the next polkit package update.

Instead, copy it to /etc/pam.d/ first (files here take priority and are never touched by pacman):

sudo cp /usr/lib/pam.d/polkit-1 /etc/pam.d/polkit-1
sudo nano /etc/pam.d/polkit-1

Add after #%PAM-1.0:

auth sufficient pam_fprintd.so

---

Caveats:

• Always add auth sufficient pam_fprintd.so after #%PAM-1.0, never before it — #%PAM-1.0 must always be the first line
• auth sufficient means fingerprint is tried first, then falls back to password if it fails or times out — you won't lose password access
• Test in a new terminal after editing — existing terminals cache authentication and won't reflect changes immediately
• If the GUI polkit dialog still shows only a password field after editing, log out and back in to restart the polkit agent
• These edits survive system updates since they're in /etc/pam.d/ — but if you ever reinstall or reset PAM configs, you'll need to redo them