Sudo with auth sufficient pam_tid.so does not work with tmux

Question

I did not really like the idea of installing some third-party sudo tool, so instead of using sudo-touchid I decided to use the /etc/pam.d/sudo trick and it works wonders. I use iTerm2 with zsh, and with that setup it works correctly. But when I use tmux (with reattach-to-user-namespace default command) sudo always asks for a password. Does anyone know how to solve this?

Answer 1

I experienced the same issues. Surprisingly, Touch ID does work in Apple's GNU screen distribution and after looking at its implementation, it seems like screen attaches to the user's per-session namespace instead of the per-user namespace.

The following patches port this approach to tmux and reattach-to-user-namespace and fix the issue for me:

1. https://github.com/ChrisJohnsen/tmux-MacOSX-pasteboard/pull/70
2. https://github.com/tmux/tmux/pull/1434

EDIT: Since these patches caused some technical issues (as explained in the pull request), I instead solved the problem using a custom PAM module to reattach to the user's per-session namespace before running the pam_tid module: https://github.com/fabianishere/pam_reattach

Answer 2

brew install pam-reattach

Then use this sudo wrapper to automatically add the necessary config (needed because macOS resets the config on updates)(beware that if this corrupts your settings you’ll be in a rough patch, so perhaps just manually editing the file and verifying it immediately might be better):

sudo () {
    unset -f sudo
    if [[ "$(uname)" == 'Darwin' ]]
    then
        if ! command grep 'pam_tid.so' /etc/pam.d/sudo --silent
        then
            command sudo sed -i -e '1s;^;auth       sufficient     pam_tid.so\n;' /etc/pam.d/sudo
        fi
        if ! command grep 'pam_reattach.so' /etc/pam.d/sudo --silent
        then
            command sudo sed -i -e '1s;^;auth     optional     pam_reattach.so\n;' /etc/pam.d/sudo
        fi
    fi
    command sudo "$@"
}

Answer 3

The solution is to use the pam_reattach module from https://github.com/fabianishere/pam_reattach/tree/master as described in earlier answers.

    brew install pam_reattach

The one caveat is that in this day of M1+ Macs, brew installs the module in /opt/homebrew/lib/pam/ instead of the default location of /usr/lib/pam. So the entries in /etc/pam.d/sudo need to include the full path to pam_reattach.so:

auth       optional       /opt/homebrew/lib/pam/pam_reattach.so
auth       sufficient     pam_tid.so

If you don't have the correct path to pam_reattach.so it is possible to get locked out of sudo. If that does happen, the trick is to open /etc/pam.d via Finder - open /etc/pam.d - click the lock icon and then temporarily allow edit permissions to /etc/pam.d/sudo so that any errors can be fixed.