pam_reattach

Reattaches a PAM session to the GUI session so Touch ID works in a multiplexer.

What it does

macOS can authenticate sudo with Touch ID via pam_tid.so, but only from a process attached to the Aqua (GUI) session. Inside tmux or screen that attachment is lost, so Touch ID silently falls back to a password prompt.

pam_reattach reattaches the process to the user’s GUI session first, restoring Touch ID — and, as a side effect, clipboard access from the same processes.

Configuration

It must be the first line of /etc/pam.d/sudo_local, before pam_tid.so:

auth       optional       /opt/homebrew/lib/pam/pam_reattach.so
auth       sufficient     pam_tid.so

sudo_local survives OS upgrades; editing /etc/pam.d/sudo directly does not.

A malformed /etc/pam.d/sudo* file can lock you out of sudo entirely. Keep a root shell open in another window while editing, and verify with sudo -k; sudo true before closing it.

Alternative to

Alternative	Type	Trade-off
`pam_tid.so` alone	Built in	Touch ID for `sudo` already works outside a multiplexer
Typing the password	—	The honest alternative; this module exists only to avoid it