fraune/touch_id_sudo.sh

To use

• After you enter this command in your terminal, you will be prompted for your sudo password (for the last time 😉)

Notes

• The /etc/pam.d/sudo_local file does not exist by default
• You can verify the permission was added by checking that the first non-comment line of /etc/pam.d/sudo_local has the text auth sufficient pam_tid.so.
• You can undo the work this script does by manually removing auth sufficient pam_tid.so from /etc/pam.d/sudo_local, and/or deleting the file in Terminal or Finder

Hi,

This only works for some time, If you get updates you have to apply again. Is there a way to make it permanently?

Thanks.

@JorgeGarciaEnki I'm glad you asked!

The tricky part is that the sudo file needs your password to be edited. My solution was to check if the permission is set at shell login, and request your password to add the permission if not.

I came up with the following block of code. You should add it to your ~/.zshrc file.

if grep -q 'auth sufficient pam_tid.so' /etc/pam.d/sudo; then
  echo "Touch ID is enabled for sudo"
else
  read "response?Touch ID is not enabled for sudo. Would you like to enable it now? [y/n]: "
  if [[ "$response" == [yY] ]]; then
    sudo grep -q -F 'auth sufficient pam_tid.so' /etc/pam.d/sudo || sudo sed -i '' '2i\
auth sufficient pam_tid.so
    ' /etc/pam.d/sudo
    if grep -q 'auth sufficient pam_tid.so' /etc/pam.d/sudo; then
      echo "'auth sufficient pam_tid.so' added to /etc/pam.d/sudo"
    fi
  else
    echo "No modifications were made to /etc/pam.d/sudo"
  fi
fi

Some final notes:

• I have only tested this with zsh
• auth sufficient pam_tid.so should be the first permission in the list on your /etc/pam.d/sudo file. If it's not, your password will still be prompted by the terminal.
• If the permission doesn't work right away, try doing a full restart of your Mac

Great, thanks!

If anyone wants to get this running in bash, try changing the read prompt:

  read -p "Touch ID is not enabled for sudo. Would you like to enable it now? [y/n]: " response

@jesseduffield

This only works for some time, If you get updates you have to apply again. Is there a way to make it permanently?

Add the line to /etc/pam.d/sudo_local apparently that file survives software updates.

@andrewcrook Thanks for the info. Next time an update comes, I’ll give this a test and update the original post!

At first, I thought the specific file name was baloney, as usually .*d directories are for stuffing whatever in, but after some searching it checks out. In the Apple Business Release notes for Sonoma (HT213893), it specifically says that changes to /etc/pam.d/sudo_local are persistent and that one can look to /etc/pam.d/sudo_local.template for more info. And lo and behold:

❯ cat /etc/pam.d/sudo_local.template
# sudo_local: local config file which survives system update and is included for sudo
# uncomment following line to enable Touch ID for sudo
#auth       sufficient     pam_tid.so

Thanks again @andrewcrook and @fatso83

I have found success using sudo_local. I will be updating the original post to reflect this.

The revisions of this gist will still reflect the hack used for older versions of macOS.