Add touch ID as valid authentication for sudo on macOS

touch-id-for-sudo.sh

awk '!/^#/ && !p { print "auth       sufficient     pam_tid.so"; p=1 }1' /etc/pam.d/sudo \
  | tee ./temp-pamd \
  && read \
  && sudo mv ./temp-pamd /etc/pam.d/sudo
  && rm ./temp-pamd

Simply copy it and run in a shell. It re-writes the /etc/pam.d/sudo file using awk, but prints the new content and waits for user to review it. If you press enter, it will actually change /etc/pam.d/sudo with the new content, or press Ctrl+C to make it exit before changing.

Awk explanation:

• !/^#/: Matches lines that do not start with #.
• !p: Ensures that the line has not been previously printed.
• print "auth sufficient pam_tid.so": Prints the required line before any non-comment line.
• p=1: This is set after the first non-comment line is encountered, ensuring the line is only printed once.
• 1: Is AWK shorthand for print the line. This happens for every line, ensuring all lines (modified and not) are printed.