GunduLabs/gaze

Gaze – Facial authentication for Linux

What it is
Gaze is a full‑stack, on‑device face‑recognition system for Linux. It provides a daemon that runs in the background, a command‑line tool for enrolling and testing faces, a GTK4 graphical UI, and PAM modules so the system can use your face to unlock the login screen, the screen saver, sudo, and other authentication points. All processing – face detection, alignment, embedding (ArcFace), and liveness detection (MiniFASNet‑V2) – happens locally; no images or biometric data leave the machine.

Key components

Component	Role
gazed	System daemon exposing a D‑Bus service (com.gundulabs.Gaze). Handles camera capture, inference, and liveness checks.
gaze (CLI)	Enroll faces, test authentication, manage stored templates, run diagnostics (gaze doctor).
gaze‑gui	GTK4/Adwaita desktop application for the same tasks with a visual interface.
pam‑gaze	PAM module that forwards login/sudo requests to the daemon.
Desktop extensions	GNOME Shell, Cinnamon, KDE Plasma, Omarchy, Hyprlock – integrate face unlock into the lock screen of each environment.
gaze‑security	Optional TPM‑backed sealing of face templates and integration with GNOME Keyring/KDE KWallet.

How it works

1. A request arrives via PAM or a desktop extension.
2. gazed grabs a frame from the configured camera.
3. The frame passes through a pipeline: SCRFD for face detection → alignment → ArcFace (ONNX) to produce an embedding → compare to stored embeddings → MiniFASNet‑V2 liveness check.
4. If the match score exceeds the configured threshold and liveness passes, the authentication succeeds.

Installation
The project supplies native packages for all major Linux distributions (Debian/Ubuntu, Fedora, openSUSE, Arch, etc.) and a one‑line installer script that adds the appropriate repository, installs the daemon, CLI, GUI, and the desktop‑specific extension for your session.
For Nix/NixOS users a flake provides gaze, gaze-gui, and a NixOS module that configures the daemon, D‑Bus, Polkit, and PAM automatically.

Configuration
Settings live in /etc/gaze/config.toml. Important sections include:

• inference – choose execution provider (cpu, openvino, vitis) and device type.
• security – set a security level that controls TPM sealing and keyring integration.
• cameras – pick the RGB camera and set a darkness threshold for IR use.
• liveness – enable/disable anti‑spoofing and adjust its confidence threshold.

Typical workflow

# Enroll a face (you’ll be prompted to look straight ahead, then move slightly)
gaze add-face default

# Test the login flow
gaze auth   # prints success/failure and timing info

The same can be done through gaze-gui.

Performance & hardware acceleration
By default Gaze runs on the CPU, but the daemon can load vendor‑provided runtimes for Intel OpenVINO or AMD Ryzen AI NPUs. After installing the driver, place the runtime under /usr/lib/gaze/runtimes and set execution_provider = "auto" (or openvino/vitis) in the config, then restart the daemon. The gaze doctor --benchmark command reports detection, recognition, and liveness inference speeds.

Security notes

• All biometric data stays on‑device; embeddings are stored on disk and can be sealed to the TPM for extra protection.
• The README recommends keeping a traditional password/PAM method as a fallback for high‑security environments.

Building from source
The project is a Rust workspace (crates/ holds the daemon, CLI, GUI, and PAM modules). Building requires Rust 1.85+, just, and system libraries (OpenCV, GStreamer, GTK4, etc.). The just build-rust command compiles everything, and just package <format> creates distro packages.

Who might use it

• Linux power users who want password‑less login on laptops or workstations.
• Enterprises deploying face unlock on fleet machines while keeping data on‑premises.
• Developers interested in on‑device biometric pipelines (the ONNX models and TPM integration are exposed as crates).

---

Bottom line: Gaze is a genuine, production‑grade facial authentication suite for Linux, covering the whole stack from low‑level camera handling and on‑device inference to PAM integration and desktop‑environment extensions. It stays within the AI/ML domain by providing on‑device face‑recognition and liveness detection, while also handling the surrounding system‑integration concerns.