4

I did not really like the idea of installing some third-party sudo tool, so instead of using sudo-touchid I decided to use the /etc/pam.d/sudo trick and it works wonders. I use iTerm2 with zsh, and with that setup it works correctly. But when I use tmux (with reattach-to-user-namespace default command) sudo always asks for a password. Does anyone know how to solve this?

5
  • What is /etc/pam.d/sudo trick ? – Alex Jul 24 '18 at 16:50
  • Adding auth sufficient pam_tid.so to the top of /etc/pam.d/sudo. – RomaValcer Jul 24 '18 at 17:53
  • 1
    @Alex apple.stackexchange.com/a/306324/263848 – JBis Jul 25 '18 at 16:36
  • @JBis Thank you for the link, actually I know this "trick", I just tried to give a clue to OP to update his question to avoid been downvoted for low quality question and use more descriptive steps instead of using word "tricks" which is kinda punishable on this site. – Alex Jul 25 '18 at 20:59
  • 1
    @Alex Ah. Maybe it'll help someone else. – JBis Jul 25 '18 at 21:00
7

I experienced the same issues. Surprisingly, Touch ID does work in Apple's GNU screen distribution and after looking at its implementation, it seems like screen attaches to the user's per-session namespace instead of the per-user namespace.

The following patches port this approach to tmux and reattach-to-user-namespace and fix the issue for me:

  1. https://github.com/ChrisJohnsen/tmux-MacOSX-pasteboard/pull/70
  2. https://github.com/tmux/tmux/pull/1434

EDIT: Since these patches caused some technical issues (as explained in the pull request), I instead solved the problem using a custom PAM module to reattach to the user's per-session namespace before running the pam_tid module: https://github.com/fabianishere/pam_reattach

1
  • 1
    I can attest that pam_reattach is a great solution and it can even be installed via brew so you can track the changes you've made to your system more easily. – dragon788 Nov 18 '19 at 16:59
0
brew install fabianishere/personal/pam_reattach

Then use this sudo wrapper to automatically add the necessary config (needed because macOS resets the config on updates):

sudo () {
    unset -f sudo
    if [[ "$(uname)" == 'Darwin' ]]
    then
        if ! command grep 'pam_tid.so' /etc/pam.d/sudo --silent
        then
            command sudo sed -i -e '1s;^;auth       sufficient     pam_tid.so\n;' /etc/pam.d/sudo
        fi
        if ! command grep 'pam_reattach.so' /etc/pam.d/sudo --silent
        then
            command sudo sed -i -e '1s;^;auth     optional     pam_reattach.so\n;' /etc/pam.d/sudo
        fi
    fi
    command sudo "$@"
}
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.