I think you should look for a Qubes OS specific solution rather than a generic linux one. In the VMs, there is a package called qubes-core-agent-passwordless-root with an rather explicit name, so you can remove it from the AppVM’s template. And there is some threads on the forum and in the docs about other solutions:
2 Likes