[feat] add privacy unlock controls and remote relocking

apps/desktop/src/platform/linux/privacy/privacy_backend_linux.cpp

@@ -63,10 +63,12 @@ class LinuxPrivacyBackend final : public PrivacyBackend {
                                         : "Checking Linux privacy support"};
   }
 
-  bool Enable(bool block_input, const PrivacyScreenText&,
+  bool Enable(bool block_input, const PrivacyScreenText& text,
               std::string& error) override {
     failure_.clear();
     emergency_ = false;
+    UpdateText(text);
+    if (!failure_.empty()) { error = failure_; return false; }
     if (!Send(block_input ? LinuxPrivacyCommand::enable_blocking
                           : LinuxPrivacyCommand::enable)) {
       error = failure_;
@@ -80,6 +82,11 @@ class LinuxPrivacyBackend final : public PrivacyBackend {
     return true;
   }
 
+  void UpdateText(const PrivacyScreenText& text) override {
+    if (socket_ >= 0 && !Send(text.allow_local_unlock ? LinuxPrivacyCommand::allow_local_unlock
+                                                    : LinuxPrivacyCommand::forbid_local_unlock))
+      failure_ = "Cannot update the local privacy unlock setting";
+  }
   void Recover() override {
     ReadReplies();
     if (recovered_) {

apps/desktop/src/platform/linux/privacy/privacy_guard.cpp

@@ -129,6 +129,8 @@ class NativePrivacy {
                   "blocking is unavailable");
   }
 
+  void SetLocalUnlockAllowed(bool allowed) { allow_local_unlock_ = allowed; }
+
   void Enable(bool block_input) {
     ++reply_.generation;
     reply_.failure[0] = '\0';
@@ -570,7 +572,7 @@ class NativePrivacy {
         shift |= symbol == XK_Shift_L || symbol == XK_Shift_R;
       }
     }
-    if (down && ctrl && alt && shift &&
+    if (allow_local_unlock_ && down && ctrl && alt && shift &&
         XkbKeycodeToKeysym(display_, keycode, 0, 0) == XK_F12) {
       reply_.emergency = true;
       Recover();
@@ -624,6 +626,7 @@ class NativePrivacy {
   std::vector<Window> hidden_roots_;
   std::map<int, std::array<bool, 256>> keys_;
   LinuxPrivacyReply reply_;
+  bool allow_local_unlock_ = true;
   Clock::time_point checked_{};
 };
 }  // namespace
@@ -676,6 +679,12 @@ int RunLinuxPrivacyGuard() {
         case LinuxPrivacyCommand::recover:
           privacy.Recover();
           break;
+        case LinuxPrivacyCommand::allow_local_unlock:
+          privacy.SetLocalUnlockAllowed(true);
+          break;
+        case LinuxPrivacyCommand::forbid_local_unlock:
+          privacy.SetLocalUnlockAllowed(false);
+          break;
         case LinuxPrivacyCommand::heartbeat:
           break;
         default:

apps/desktop/src/platform/linux/privacy/privacy_guard.h

@@ -22,6 +22,8 @@ enum class LinuxPrivacyCommand : uint8_t {
   enable_blocking,
   recover,
   heartbeat,
+  allow_local_unlock,
+  forbid_local_unlock,
 };
 
 struct LinuxPrivacyReply {