lorenzo-coslado/macos-faceid

Mugshot is a macOS menu bar app that lets you unlock the sudo command with your face. On macOS, sudo is what an administrator types in the terminal to run commands that change the system. Normally you type your password each time. With Mugshot, the camera recognizes you and unlocks sudo automatically. The app runs face recognition entirely on your Mac, and no face data ever leaves your computer. It began as a weekend project and grew into a complete app with a guided setup, a settings window, and a choice at every prompt between Face ID, Touch ID, and your password. Installing it involves downloading a signed app, dragging it into your Applications folder, and launching it. A face icon appears in the menu bar. You click it, choose to set up your face, and follow a short enrollment process that takes a few seconds. Then you open Settings and turn on Face ID for sudo. Because recent macOS versions lock down changes to the sudo configuration, Mugshot uses a small helper and walks you through two one-time approvals: letting the helper run, and granting it Full Disk Access so it can write one file. After that, every time you run a sudo command, a panel appears, the camera scans your face, and sudo unlocks. If the match fails, you simply get the normal password prompt. The app works by splitting the job in two. A root process started by sudo cannot reach the camera, because macOS blocks camera access in that context. So a small PAM module hands the request to a daemon running in your login session, which owns the camera. The daemon finds your face, turns it into an embedding, and compares it to the face you enrolled. The PAM rule is set to sufficient, which means a failed match falls through to your password. The author is clear that this is not a security product. A regular webcam can be fooled by a printed photo or a video, unlike Apple's real Face ID which uses an infrared depth sensor. Mugshot has no such protection. Your face embeddings stay on your machine, and you can never lock yourself out because the password always remains as a fallback.