One morning my thumb stopped working. Touch ID for sudo was dead. This feature lets a fingerprint replace a typed password in the terminal. I type sudo forty times a day. The terminal asked for my password every time. I do not live like that.
The quiet “(a)” build
Nothing changed overnight. That was not true. sw_vers showed a build number that ends in “(a)”. That mark is the quiet signature of a macOS Rapid Security Response. These are the small emergency patches that Apple ships between full updates. The patch installed itself overnight, did its re-staging, and left no message.
The patch broke two things. The search for them was the fun part.
The file that updates must not delete
Touch ID for sudo lives in one file: /etc/pam.d/sudo_local. Apple keeps this file separate from the main sudo config on purpose. The separation exists so that updates do not delete it. That is the only reason the file exists. The security patch deleted it anyway.
The file timestamps told the story. The template file was unchanged since February. My config file was gone after the patch’s re-staging. The fix is two lines. Copy the template back. Remove the comment mark from the line that enables fingerprint authentication.
The keyboard and the Secure Enclave
My thumb still did not work. That is how I found the second problem. bioutil said that Touch ID was enrolled and enabled. But the sensor is in my Magic Keyboard.
An external keyboard does not send fingerprints over Bluetooth. It holds a cryptographic pairing with the Mac’s Secure Enclave. The Secure Enclave is a dedicated security chip. It keeps biometric data away from the OS itself. The patch reset that pairing. The keyboard and the Mac could still talk, but they no longer trusted each other with my thumbprint.
Five seconds of USB-C
The fix for the broken pairing is physical. Connect the keyboard to the Mac with a USB-C cable. Wait approximately five seconds. That is all.
The wired connection is the trusted channel for a new pairing. The cable is proof that a person is at the machine. Disconnect the cable. The fingerprint works again. The fix for the wireless problem was a wire.
The full repair took 34 minutes. I used most of that time to prove what was not broken. I used the last five minutes to write the diagnosis into my notes. Apple will ship more Rapid Security Responses. This failure will occur again. Next time the fix is two commands and a cable, and the patch does not get to take the morning.