19 ms·

This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal compu

This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?

beyondcompute 6y ago
I’ve just added this to my .bash_profile: enable-sudo-touchid() { sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo } But probably automating the check (if the automated checker has the correct permission) would not be that hard.
- ed25519FUUU 6y ago
  The hard part with these kinds of fixes is that they evaluate every time you create a new shell or tab, which for me is very frequently. It’s already starting to add noticeable latency from all of the various eval statements in there. Edit: I missed it’s a function def which should be fine speed wise.
  - fwip 6y ago
    That's a function definition, the only overhead will be parsing, not evaluation.
- jmarcher 6y ago
  A step further so you don't have to think about enabling it: sudo() { unset -f sudo if [[ "$(uname)" == 'Darwin' ]] && ! grep 'pam_tid.so' /etc/pam.d/sudo --silent; then sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo fi sudo "$@" }
  - beyondcompute 6y ago
    Thanks! That looks good! Thought on the second thought, I’ll continue to use the more “manual” method for now. As it gives me more control and it would be easier to switch off when touch ID sudo will be supported more officially.
  - mkskm 6y ago
    Here's another function in Fish that incorporates the other suggestions offered in this thread. function sudo --description "Execute a command as another user." if [ (uname) = "Darwin" ] set --local needle "^auth\b.*\bpam_$reattach\|tid\|watchid$\.so\$" if ! grep $needle --silent /etc/pam.d/sudo && \ [ -f /usr/local/lib/pam/pam_reattach.so* ] && \ [ -f /usr/local/lib/pam/pam_watchid.so* ] command sudo sh -c " cat << EOF >/etc/pam.d/sudo auth optional pam_reattach.so auth sufficient pam_tid.so auth sufficient pam_watchid.so \$(grep -v '$needle' /etc/pam.d/sudo) EOF"; or return $status end end command sudo $argv end
- ethanpil 6y ago
  Why not run a launchd script on boot that does the update? Does it need to be in the .bashrc?
ktapcnbje 6y ago
Does `sudo chflags schg /etc/pam.d/sudo` work?
draugadrotten 6y ago
curl -sL https://gist.githubusercontent.com/RichardBronosky/31660eb4b0f0ba5e673b9bc3c9148a70/raw/touchid_sudo.sh https://gist.githubusercontent.com/RichardBronosky/31660eb4b... | bash This helps.
- envy2 6y ago
  This "download random script from internet and execute" thing is a terrible idea, even moreso to put in bash_profile...
- IncRnd 6y ago
  Seems secure.
jeffbee 6y ago
This is a very macOS problem. Why does it reset every preference on updates? The one that kills me is wake-on-lan, that gets turned back on regardless. Hate!
- nullserver 6y ago
  Back in the day I used to tweak my Linux box, win3.1/95, vim, android phone, etc. endlessly. After awhile they would all become unusable, and I would reinstall everything back to default and try again. Great for leaning, lousy for day to day work. Resetting things back to a known state can make life lot easier. In 10 years I can’t recall needing to reset a Mac.
  - Daho0n 6y ago
    Because it does so itself. It is even worse to have lost settings than having windows rot. At least in Windows rot is the problem, not the fix.
- derefr 6y ago
  Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the same in the end.” (In many ways, macOS’s update system now reuses the logic from iOS’s IPSW firmware-update system. You can even now download macOS updates from Apple as IPSW files, and then use Apple Configurator to push them to macOS devices.) Unlike ChromeOS/CoreOS, after the first-round SHA verification of the volume, macOS will then patch the new OS-base-image volume with certain files from your current OS-base-image volume, if 1. they’re distinct from the ones it expected to be there, and 2. they appear on a whitelist of known-safe files. If any of this patching happens, the OS volume’s metadata tree will then be re-hashed, and the new hash will be blessed by the volume-signing utility. (If you’ve seen a “Recovered Files” directory on your desktop after an update, and it’s contained a “foo.system_default” file, that’s a copy of the file that macOS would have composed into the OS volume if it hadn’t found your known-safe customized file to use instead. /etc/shells is a usual trigger.) Some preference files in /System/Library are known-safe; but others aren’t. It’s a whitelist, and it’s a conservative one. Preference files in /Library live in the user volume, not the OS volume, and so will never be wiped. This is why most of the “trivial” preferences stick around. Note that by “known-safe” here, I don’t mean “can’t be customized to malicious ends.” This isn’t a security thing. It’s an ABI stability thing. These files are safe in that they’re known to have the same ABI format between OS versions, and so keeping a customized version of them around won’t confuse newer versions of system daemons. It’s about the same as if Linux had a set of known-safe DKMS modules that use interfaces that the kernel intentionally doesn’t change between releases, such that the kernel module files composed from those DKMS modules could be reused by the new kernel without requiring decompilation, rather than being tossed out at every single kernel update.
yrro 6y ago
Does OS X not have /etc/sudoers.d?
- bmurphy1976 6y ago
  It does, but this is a PAM configuration, so I'm not sure how /etc/sudoers.d would help...
  - yrro 6y ago
    Good point! :)
m463 6y ago
Apple needs a solution to this. People getting their pf rules thrown away each time - it is like unlocking your front door each time you run the vacuum cleaner.
amrrs 6y ago
Did this work on iTerm?
- zzzmarcus 6y ago
  Yes
- Siira 6y ago
  It doesn’t (didn’t) play too well with the full screen hotkey windows.

beyondcompute 6y ago

I’ve just added this to my .bash_profile: enable-sudo-touchid() { sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo } But probably automating the check (if the automated checker has the correct permission) would not be that hard.

ed25519FUUU 6y ago
The hard part with these kinds of fixes is that they evaluate every time you create a new shell or tab, which for me is very frequently. It’s already starting to add noticeable latency from all of the various eval statements in there. Edit: I missed it’s a function def which should be fine speed wise.
- fwip 6y ago
  That's a function definition, the only overhead will be parsing, not evaluation.
jmarcher 6y ago
A step further so you don't have to think about enabling it: sudo() { unset -f sudo if [[ "$(uname)" == 'Darwin' ]] && ! grep 'pam_tid.so' /etc/pam.d/sudo --silent; then sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo fi sudo "$@" }
- beyondcompute 6y ago
  Thanks! That looks good! Thought on the second thought, I’ll continue to use the more “manual” method for now. As it gives me more control and it would be easier to switch off when touch ID sudo will be supported more officially.
- mkskm 6y ago
  Here's another function in Fish that incorporates the other suggestions offered in this thread. function sudo --description "Execute a command as another user." if [ (uname) = "Darwin" ] set --local needle "^auth\b.*\bpam_$reattach\|tid\|watchid$\.so\$" if ! grep $needle --silent /etc/pam.d/sudo && \ [ -f /usr/local/lib/pam/pam_reattach.so* ] && \ [ -f /usr/local/lib/pam/pam_watchid.so* ] command sudo sh -c " cat << EOF >/etc/pam.d/sudo auth optional pam_reattach.so auth sufficient pam_tid.so auth sufficient pam_watchid.so \$(grep -v '$needle' /etc/pam.d/sudo) EOF"; or return $status end end command sudo $argv end
ethanpil 6y ago
Why not run a launchd script on boot that does the update? Does it need to be in the .bashrc?

ktapcnbje 6y ago

Does `sudo chflags schg /etc/pam.d/sudo` work?

draugadrotten 6y ago

curl -sL https://gist.githubusercontent.com/RichardBronosky/31660eb4b0f0ba5e673b9bc3c9148a70/raw/touchid_sudo.sh https://gist.githubusercontent.com/RichardBronosky/31660eb4b... | bash This helps.

envy2 6y ago
This "download random script from internet and execute" thing is a terrible idea, even moreso to put in bash_profile...
IncRnd 6y ago
Seems secure.

jeffbee 6y ago

This is a very macOS problem. Why does it reset every preference on updates? The one that kills me is wake-on-lan, that gets turned back on regardless. Hate!

nullserver 6y ago
Back in the day I used to tweak my Linux box, win3.1/95, vim, android phone, etc. endlessly. After awhile they would all become unusable, and I would reinstall everything back to default and try again. Great for leaning, lousy for day to day work. Resetting things back to a known state can make life lot easier. In 10 years I can’t recall needing to reset a Mac.
- Daho0n 6y ago
  Because it does so itself. It is even worse to have lost settings than having windows rot. At least in Windows rot is the problem, not the fix.
derefr 6y ago
Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the same in the end.” (In many ways, macOS’s update system now reuses the logic from iOS’s IPSW firmware-update system. You can even now download macOS updates from Apple as IPSW files, and then use Apple Configurator to push them to macOS devices.) Unlike ChromeOS/CoreOS, after the first-round SHA verification of the volume, macOS will then patch the new OS-base-image volume with certain files from your current OS-base-image volume, if 1. they’re distinct from the ones it expected to be there, and 2. they appear on a whitelist of known-safe files. If any of this patching happens, the OS volume’s metadata tree will then be re-hashed, and the new hash will be blessed by the volume-signing utility. (If you’ve seen a “Recovered Files” directory on your desktop after an update, and it’s contained a “foo.system_default” file, that’s a copy of the file that macOS would have composed into the OS volume if it hadn’t found your known-safe customized file to use instead. /etc/shells is a usual trigger.) Some preference files in /System/Library are known-safe; but others aren’t. It’s a whitelist, and it’s a conservative one. Preference files in /Library live in the user volume, not the OS volume, and so will never be wiped. This is why most of the “trivial” preferences stick around. Note that by “known-safe” here, I don’t mean “can’t be customized to malicious ends.” This isn’t a security thing. It’s an ABI stability thing. These files are safe in that they’re known to have the same ABI format between OS versions, and so keeping a customized version of them around won’t confuse newer versions of system daemons. It’s about the same as if Linux had a set of known-safe DKMS modules that use interfaces that the kernel intentionally doesn’t change between releases, such that the kernel module files composed from those DKMS modules could be reused by the new kernel without requiring decompilation, rather than being tossed out at every single kernel update.

yrro 6y ago

Does OS X not have /etc/sudoers.d?

bmurphy1976 6y ago
It does, but this is a PAM configuration, so I'm not sure how /etc/sudoers.d would help...
- yrro 6y ago
  Good point! :)

m463 6y ago

Apple needs a solution to this. People getting their pf rules thrown away each time - it is like unlocking your front door each time you run the vacuum cleaner.

amrrs 6y ago

Did this work on iTerm?

zzzmarcus 6y ago
Yes
Siira 6y ago
It doesn’t (didn’t) play too well with the full screen hotkey windows.