-
-
Save fraune/0831edc01fa89f46ce43b8bbc3761ac7 to your computer and use it in GitHub Desktop.
sudo sh -c 'echo "auth sufficient pam_tid.so" > /etc/pam.d/sudo_local' |
Hi,
This only works for some time, If you get updates you have to apply again. Is there a way to make it permanently?
Thanks.
@JorgeGarciaEnki I'm glad you asked!
The tricky part is that the sudo file needs your password to be edited. My solution was to check if the permission is set at shell login, and request your password to add the permission if not.
I came up with the following block of code. You should add it to your ~/.zshrc
file.
if grep -q 'auth sufficient pam_tid.so' /etc/pam.d/sudo; then
echo "Touch ID is enabled for sudo"
else
read "response?Touch ID is not enabled for sudo. Would you like to enable it now? [y/n]: "
if [[ "$response" == [yY] ]]; then
sudo grep -q -F 'auth sufficient pam_tid.so' /etc/pam.d/sudo || sudo sed -i '' '2i\
auth sufficient pam_tid.so
' /etc/pam.d/sudo
if grep -q 'auth sufficient pam_tid.so' /etc/pam.d/sudo; then
echo "'auth sufficient pam_tid.so' added to /etc/pam.d/sudo"
fi
else
echo "No modifications were made to /etc/pam.d/sudo"
fi
fi
Some final notes:
- I have only tested this with
zsh
auth sufficient pam_tid.so
should be the first permission in the list on your/etc/pam.d/sudo
file. If it's not, your password will still be prompted by the terminal.- If the permission doesn't work right away, try doing a full restart of your Mac
Great, thanks!
If anyone wants to get this running in bash, try changing the read
prompt:
read -p "Touch ID is not enabled for sudo. Would you like to enable it now? [y/n]: " response
This only works for some time, If you get updates you have to apply again. Is there a way to make it permanently?
Add the line to /etc/pam.d/sudo_local
apparently that file survives software updates.
@andrewcrook Thanks for the info. Next time an update comes, I’ll give this a test and update the original post!
At first, I thought the specific file name was baloney, as usually .*d
directories are for stuffing whatever in, but after some searching it checks out. In the Apple Business Release notes for Sonoma (HT213893), it specifically says that changes to /etc/pam.d/sudo_local
are persistent and that one can look to /etc/pam.d/sudo_local.template
for more info. And lo and behold:
❯ cat /etc/pam.d/sudo_local.template
# sudo_local: local config file which survives system update and is included for sudo
# uncomment following line to enable Touch ID for sudo
#auth sufficient pam_tid.so
Thanks again @andrewcrook and @fatso83
I have found success using sudo_local. I will be updating the original post to reflect this.
The revisions of this gist will still reflect the hack used for older versions of macOS.
To use
Notes
/etc/pam.d/sudo_local
file does not exist by default/etc/pam.d/sudo_local
has the textauth sufficient pam_tid.so
.auth sufficient pam_tid.so
from/etc/pam.d/sudo_local
, and/or deleting the file in Terminal or Finder