touchid

Enables Touch ID for sudo on macOS by adding pam_tid.so to /etc/pam.d/sudo_local.

sudo_local (macOS Sonoma and later) survives OS updates, unlike editing /etc/pam.d/sudo directly. The lineinfile regexp also matches the commented-out template line, and leaves other lines (e.g. pam_reattach for tmux) untouched.

Requirements

• macOS 14 (Sonoma) or later.
• Privilege escalation: run with -K/--ask-become-pass (or have passwordless sudo), since the task writes to /etc/pam.d.

Role Variables

None. The task is skipped on hosts that aren't macOS.

Example Playbook

- hosts: anubis
  roles:
    - role: touchid

Notes

• Tagged touchid.
• Touch ID does not work over plain ssh sessions; inside tmux it needs pam_reattach.