QubesOS-Scripts/sudo-dom0.sh

sudo authselect create-profile sudo-dom0-prompt --base-on=sssd --symlink-meta --symlink-pam
sudo mv /etc/authselect/custom/sudo-dom0-prompt/system-auth /etc/authselect/custom/sudo-dom0-prompt/system-auth.original_aside
sudo cp /etc/authselect/system-auth /etc/authselect/custom/sudo-dom0-prompt

sudo sed -i '/^auth/d' /etc/authselect/custom/sudo-dom0-prompt/system-auth
sed -i '/^account/{0,/auth/s/^auth /&\n        auth  [success=1 default=ignore]  pam_exec.so seteuid \ /usr/lib/qubes/qrexec-client-vm dom0 qubes.VMAuth \ /bin/grep -q ^1$/&\n        auth  requisite  pam_deny.so\n        auth  required   pam_permit.so\n\n/' /etc/authselect/custom/sudo-dom0-prompt/system-auth
sudo authselect select custom/sudo-dom0-prompt

sudo sed -i '/^%qubes/s/.*/user ALL=(ALL) ALL/' /etc/sudoers.d/qubes

sudo rm /etc/polkit-1/rules.d/00-qubes-allow-all.rules