Circumvent sudo fingerprint in tramp

Question

Having recently got a device that has a fingerprint reader built in, I set to enabling fingerprint authentication. I have this is sudo now, and this is useful in my terminal.

The issue I'm running into is that when I use emacs tramp to elevate privileges, it calls sudo and waits for the fingerprint to be read (this does work, it just doesn't prompt anything). Where in a terminal I can Ctrl+C to go to password auth if I feel like it (all I did to /etc/pam.d/sudo is add auth sufficient pam_fprintd.so to the top), I can't here as with tramp that is nicely abstracted. I would prefer to just disable fingerprint auth for tramp, but keep it in normal sudo. Is this possible?

I've looked things up and the only thing that spoke to me as a possible solution is using a different privilege escalator, such as su or run0, but those require the root password, which I have disabled. I could theoretically use doas, but it feels weird installing a whole separate stack that I'll barely use...

Any help is appreciated

Answer 1

Fingerprint readers are supported in Tramp, starting with version 2.7.1.5.

Answer 2

Sudo doesn't give the calling user much control over authentication methods. But you can get some control through the PAM stack. One way to solve your problem would be to have sudo detect when it's being called from Tramp, and skip fingerprint authentication in that case.

Here's a rough idea of how you can do this (I can't test this in the short term):

1. Create a program /usr/local/bin/sudo_should_skip_fingerprints that exits with status 1 to use fingerprints and 0 to skip fingerprints.
2. Add the line below to your PAM configuration.

auth   [success=1 default=ignore] pam_exec.so quiet /usr/local/bin/sudo_should_skip_fingerprints
auth   sufficient   pam_fprintd.so
…

For sudo_should_skip_fingerprints, check if the environment indicates a call from Tramp. Something like this:

#!/bin/sh
case ",$INSIDE_EMACS," in
  *,tramp:*) exit 1;;
  *) exit 0;;
esac