Comment 10 for bug 1532264

My thoughts exactly. It seems the enrollment files are stored in /var/lib/fprintd, which is already restricted to root access with read access for others, and the directories and files under it are root only without even read permissions for others, yet fprintd-enroll seems able to change them even when not run as root. What am I missing here?