1

Does the usual auth sufficient pam_tid.so in /etc/pam.d/sudo or /etc/pam.d/sudo_local work on macOS 15 Sequoia (e.g. as described in this question)? I upgraded yesterday and went to re-apply this setting that lets you use touch ID with sudo but I noticed that there is no "pam_tid.so" file anymore in /usr/lib/pam the file is now "pam_tid.so.2". Maybe the 2 postfix is because it's multi-architecture binary? I'm on an M2 mac.

I'm just wondering if anyone else has confirmed touch ID works the same, or if we should use the filename with the ".2". I've searched a bit but not found anything. I don't want to break sudo access, it can be a real pain, so I'm hesitant to test.

Improve this question

1 Answer 1

Reset to default
1

Well I decided to test it out anyways and the same line does work. I noticed that all the authentication methods listed in /etc/pam.d/sudo looked the same (with no ".2" in them) despite those files also having different names in /usr/lib/pam. I copied sudo_local.template to sudo_local and uncommented (removed the leading hash mark) the final "pam_tid.so" line. Now touch ID works for sudo again. I only just learned of the sudo_local file today too, so hopefully this means the change will persist across OS updates in the future.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .