I recently needed to run sudo commands through Claude Code, but ran into a problem: Claude Code’s Bash tool isn’t interactive, so there’s no way to type a password or scan a fingerprint when sudo prompts for authentication.

The commonly suggested workaround is to use SUDO_ASKPASS with openssh-askpass, but that only shows a basic password dialog with no fingerprint support. Not ideal when you’ve got a fingerprint reader and you’d rather not type your password every time Claude needs root.

The solution

Use pkexec instead of sudo. pkexec goes through polkit, which triggers the native GNOME authentication dialog — the same one you see when installing apps in GNOME Software or authenticating in 1Password. This dialog supports both password and fingerprint via pam_fprintd.

On Fedora with GNOME, there’s nothing to install. pkexec and the GNOME polkit agent are already there. Just use pkexec <command> wherever you’d use sudo <command>:

pkexec dnf install -y tailscale
pkexec systemctl enable --now tailscaled
pkexec tailscale set --ssh

A GNOME auth dialog will pop up for each command, and you can tap your fingerprint to approve it.

Caveat

pkexec isn’t a drop-in sudo replacement — it doesn’t support flags like -u, -E, or -A. But for simple “run this as root” commands, which is 99% of what Claude Code needs, it works perfectly.