Really surprising that Apple didn't include this by default.
Use Touch ID for Sudo on Mac
101–110 of 221 posts
Re: Use Touch ID for Sudo on Mac
#102Earlier quoted context omitted.
I’ve just added this to my .bash_profile: enable-sudo-touchid() { sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo } But probably automating the check (if the automated checker has the correct permission) would not be that hard.
The hard part with these kinds of fixes is that they evaluate every time you create a new shell or tab, which for me is very frequently. It’s already starting to add noticeable latency from all of the various eval statements in there. Edit: I missed it’s a function def which should be fine speed wise.
That's a function definition, the only overhead will be parsing, not evaluation.
Re: Use Touch ID for Sudo on Mac
#103You might need to make the file writable before editing it:
sudo chmod +w /etc/pam.d/sudoRe: Use Touch ID for Sudo on Mac
#104This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?
Does OS X not have /etc/sudoers.d?
Re: Use Touch ID for Sudo on Mac
#105This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?
This is a very macOS problem. Why does it reset every preference on updates? The one that kills me is wake-on-lan, that gets turned back on regardless. Hate!
Back in the day I used to tweak my Linux box, win3.1/95, vim, android phone, etc. endlessly.
After awhile they would all become unusable, and I would reinstall everything back to default and try again. Great for leaning, lousy for day to day work.
Resetting things back to a known state can make life lot easier.
In 10 years I can’t recall needing to reset a Mac.
Re: Use Touch ID for Sudo on Mac
#106This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?
This is a very macOS problem. Why does it reset every preference on updates? The one that kills me is wake-on-lan, that gets turned back on regardless. Hate!
Because, like ChromeOS/CoreOS, modern macOS now does image-based updates.
A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the same in the end.”
(In many ways, macOS’s update system now reuses the logic from iOS’s IPSW firmware-update system. You can even now download macOS updates from Apple as IPSW files, and then use Apple Configurator to push them to macOS devices.)
Unlike ChromeOS/CoreOS, after the first-round SHA verification of the volume, macOS will then patch the new OS-base-image volume with certain files from your current OS-base-image volume, if 1. they’re distinct from the ones it expected to be there, and 2. they appear on a whitelist of known-safe files.
If any of this patching happens, the OS volume’s metadata tree will then be re-hashed, and the new hash will be blessed by the volume-signing utility.
(If you’ve seen a “Recovered Files” directory on your desktop after an update, and it’s contained a “foo.system_default” file, that’s a copy of the file that macOS would have composed into the OS volume if it hadn’t found your known-safe customized file to use instead. /etc/shells is a usual trigger.)
Some preference files in /System/Library are known-safe; but others aren’t. It’s a whitelist, and it’s a conservative one.
Preference files in /Library live in the user volume, not the OS volume, and so will never be wiped. This is why most of the “trivial” preferences stick around.
Note that by “known-safe” here, I don’t mean “can’t be customized to malicious ends.” This isn’t a security thing. It’s an ABI stability thing. These files are safe in that they’re known to have the same ABI format between OS versions, and so keeping a customized version of them around won’t confuse newer versions of system daemons.
It’s about the same as if Linux had a set of known-safe DKMS modules that use interfaces that the kernel intentionally doesn’t change between releases, such that the kernel module files composed from those DKMS modules could be reused by the new kernel without requiring decompilation, rather than being tossed out at every single kernel update.
Re: Use Touch ID for Sudo on Mac
#107You also need to remove the line below, otherwise, you'll be asked to authenticate twice using both methods:
auth sufficient pam_smartcard.soRe: Use Touch ID for Sudo on Mac
#108This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?
Does OS X not have /etc/sudoers.d?
It does, but this is a PAM configuration, so I'm not sure how /etc/sudoers.d would help...
Re: Use Touch ID for Sudo on Mac
#109The article will not allow sudo changes on Big Sur - at least, not without changing permissions of the sudo file first: 1. sudo -Si 2. chmod 644 /etc/pam.d/sudo 3. vi /etc/pam.d/sudo 4. Add the 'Auth sufficient pam_tid.so' line 5. chmod 444 /etc/pam.d/sudo 6. ... 7. Profit! Very handy tip though, thanks!
:w!
:wq!