Operating Environment:
- OS: MacOS Sonoma 14.5
- Device: M1 MacBook Pro
Explanation
In macOS Sonoma, a new method has been introduced to enable Touch ID when running sudo
commands, making it more persistent across system updates. Previously, editing the /etc/pam.d/sudo
file was necessary, but these changes would often revert after an update, requiring reconfiguration. With Sonoma, the settings can be added to a separate file /etc/pam.d/sudo_local
, which isn't overwritten during updates, allowing Touch ID to remain enabled for sudo
commands consistently.
Steps to Enable Touch ID for sudo
1. Create and Edit the Configuration File
Create a new configuration file based on the template provided in macOS Sonoma.
sudo cp /etc/pam.d/sudo_local.template /etc/pam.d/sudo_local
Edit the newly created file with your preferred text editor:
sudo vim /etc/pam.d/sudo_local
In the file, locate the following line, Uncomment it by removing the #
:
- #auth sufficient pam_tid.so
+ auth sufficient pam_tid.so
Alternative Method Using sed
and tee
You can achieve the same result with a single command using sed
and tee
:
sed -e 's/^#auth/auth/' /etc/pam.d/sudo_local.template | sudo tee /etc/pam.d/sudo_local
2. Confirm the Operation
Open a new terminal session and run a sudo
command to test the setup:
sudo ls
You should be prompted to authenticate using Touch ID. If the command executes after Touch ID authentication, the setup is complete.
Background
Previously, enabling Touch ID for sudo
required modifying /etc/pam.d/sudo
, but these changes did not persist through macOS updates. By leveraging the new /etc/pam.d/sudo_local
configuration in macOS Sonoma, we can ensure that Touch ID settings for sudo
remain intact even after system updates.
The /etc/pam.d/sudo
file now includes the following:
# sudo: auth account password session
auth include sudo_local
auth sufficient pam_smartcard.so
auth required pam_opendirectory.so
account required pam_permit.so
password required pam_deny.so
session required pam_permit.so
This configuration ensures that the settings in /etc/pam.d/sudo_local
are loaded and used, maintaining Touch ID functionality for sudo
commands.
Please note that for macOS versions earlier than Sonoma, manual editing of /etc/pam.d/sudo
is still required to enable Touch ID for sudo
commands.
Top comments (0)