I recently needed to run sudo commands through Claude Code on Linux, but ran into a problem: Claude Code’s Bash tool isn’t interactive, so there’s no way to type a password or scan a fingerprint when sudo prompts for authentication.

The commonly suggested workaround is to use SUDO_ASKPASS with openssh-askpass, but that only shows a basic password dialog with no fingerprint support. Not ideal when you’ve got a fingerprint reader and you’d rather not type your password every time Claude needs root.

The solution

Use pkexec instead of sudo. pkexec goes through polkit, which triggers the native GNOME authentication dialog, the same one you see when installing apps in GNOME Software or authenticating in 1Password. This dialog supports both password and fingerprint through pam_fprintd.

On Fedora and other Linux distros with GNOME, there’s nothing to install. pkexec and the GNOME polkit agent are already there. Just use pkexec <command> wherever you’d use sudo <command>:

pkexec dnf install -y tailscale
pkexec systemctl enable --now tailscaled
pkexec tailscale set --ssh

A GNOME auth dialog will pop up for each command, and you can tap your fingerprint to approve it.

Caveat

pkexec isn’t a drop-in sudo replacement. It doesn’t support flags like -u, -E, or -A. But for simple “run this as root” commands, which is 99% of what Claude Code needs, it works perfectly.

Making it stick

You can tell Claude Code to always use pkexec by adding an instruction to your global CLAUDE.md file at ~/.claude/CLAUDE.md:

When running commands that require root, use `pkexec` instead of `sudo`.

This applies across all your projects, so you only need to set it once.