0

I am following a guide to recompile sudo with insults. However, I felt uncomfortable disabling SIP so I modified it a bit to allow me to use it with SIP enabled. Unfortunately recompiling sudo broke my ability to authenticate sudo using TouchID. I investigated this and discovered it had to do with the entitlements codesigning used by sudo.

If you look at the Entitlements for sudo: sudo cp /usr/bin/sudo . && sudo codesign -d --entitlements :- ./sudo* you get:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.private.AuthorizationServices</key>
    <array>
        <string>com.apple.security.sudo</string>
    </array>
</dict>
</plist>

Apparently this com.apple.private.AuthorizationServices key is necessary to the enabling of TouchID for sudo.

Proof: ./sudo ls prompts me for TouchID ✅

sudo codesign --remove-signature ./sudo && sudo -k && ./sudo ls does not prompt me for TouchID and just asks me for my password ❌

Is this only because I continue to have SIP enabled? Does disabling SIP remove the code signing requirements for TouchID?

Edit 1: Attempts at fixes: What I am trying to do is just remove the code signature from a copy of /usr/bin/sudo and allow TouchID with that (so I can be sure any error isn't coming from recompiling)

  1. Make an editable copy of /usr/bin/sudo to work with: sudo cp /usr/bin/sudo .
  2. remove code signing sudo codesign --remove-signature ./sudo
  3. Try to re-apply entitlements sudo codesign -d --entitlements :- $(which sudo)>entitlements.plist. && sudo codesign --entitlements entitlements.plist -s "signature" ./sudo
  4. Try to execute ./sudo and see if it prompts for TouchID: ./sudo ls prints [1] 12559 killed ./sudo ls

So the process is immediately being killed. I'm guessing macOS is noticing an improperly signed executable and killing it. What is the proper way to enable TouchID on ./sudo?

Edit 2: Does anybody know where I can find logs to help track this? Console.app just says

com.apple.libsqlite3    error   14:44:27.950193 -0400   taskgated   cannot open file at line 42270 of [95fbac39ba]
com.apple.libsqlite3    error   14:44:27.950216 -0400   taskgated   os_unix.c:42270: (2) open(/var/db/DetachedSignatures) - No such file or directory

Trying to run sudo dtruss ./sudo is weird. It will give me 1 of 4 error messages each time it's run:

  1. dtrace: failed to control pid 13256: process exec'd set-id or unobservable program

  2. Failed to read dyld info for process 13279 (4) dtrace: failed to control pid 13279: process exec'd set-id or unobservable program

  3. dtrace: failed to execute ./sudo: Could not create symbolicator for task

  4. Failed to read dyld info for process 13833 (4) dtrace: failed to execute ./sudo: Could not create symbolicator for task

Edit 3:

trying to verify the code sign signature seems to be okay

sudo codesign --verify --verbose  ./sudo
./sudo: valid on disk
./sudo: satisfies its Designated Requirement

spctl says it is rejected, but doesn't give a reason why

sudo spctl -a -vvvv ./sudo
./sudo: rejected
origin=Mac Developer: vegerot@mac.com (is the UUID private?)

compared to /usr/bin/sudo

sudo spctl -a -vvvv $(which sudo)
/usr/bin/sudo: rejected (the code is valid but does not seem to be an app)
origin=Software Signing

So even Apple's sudo is rejected, but it says the code the valid (I'm guessing spctl is only for app bundles (like .app)). Since it doesn't say ./sudo is valid, I'm guessing that means it's invalid, but I can't make it give more information

  • If you are uncomfortable with removing sip even temporally then note that messing around with sudo is more risky and as you have shown more complex. Easier to disable sip and reinstate it later – mmmmmm Sep 19 '19 at 12:39
  • You're not wrong. Now it is just more of a curiosity project than anything. If I have TouchID authentication, I don't really need insults anyways 😛. What I am interested in now is trying to copy /usr/bin/sudo (that works with TouchID), removing Apple's code signature, and trying to get PAM TouchID to work again – Max Coplan Sep 19 '19 at 16:17

You must log in to answer this question.

Browse other questions tagged .