password is read from stdin, not TTY

[dw]

trafficstars

repro: echo foo | doas cat

This breaks piping something to a command via doas, and breaks tools (dw/mitogen) expecting it to behave like the BSD version

[slicer69]

I've tested this and it works as expected on FreeBSD.

On Linux it was echoing the password when a pipe was used, which is obviously not good. I've fixed that.

On Linux piped data is not being forwarded to the command run by doas, it is intercepted by doas. Will look into that further.

[linuxergr]

Is there any progress about this, as mentioned above?

[slicer69]

No, and there probably won't be until someone submits a patch for Linux compatibility that doesn't break other platforms.

[sandsmark]

it doesn't seem like this does any tty or pty handling at all?

This is the basic stuff needed for securely reading the password AFAIK: https://github.com/sudo-project/sudo/blob/9e111eae57524ca72002ad1db36eb68ccd50b167/src/tgetpass.c#L110-L284

I don't think that is linux specific.

[slicer69]

This is Linux specific, the other platforms just handle this, basically automatically.

[henriquehbr]

Quoting my suggested solution from https://github.com/Duncaen/OpenDoas/issues/21

It turns out i found a pretty good workaround for this by using expect for automatically entering input on interactive prompts, i ended up with something like this:

#!/usr/bin/expect
spawn doas -- pacman --noconfirm -U yay-bin-10.2.3-1-x86_64.pkg.tar.zst
expect "Password: " {send -- "password\r"}
expect eof

Hope it helps someone :)

[jdebp]

This is not a strictly problem in doas. This is a difference between the basic default "glass TTY" conversation functions supplied by LinuxPAM on Linux, by OpenPAM on the BSDs, and by doas itself.

• The openpam_ttyconv() function in OpenPAM opens /dev/tty if standard input is not a terminal.
• The misc_conv() function in LinuxPAM does nothing at all if standard input is not a terminal.
• The pam_tty_conv() supplied by doas itself for Illumos just blithely assumes that standard input is a terminal.

It wouldn't be hard to adapt the Illumos pam_tty_conv() to Linux, and make it better for Illumos as a side-effect. But that would only fix this problem for "doas" and not fix it for everything else that uses LinuxPAM and hits the same problem for the same reason.

There's no bug filed about this at the LinuxPAM bug tracker directly nor at the Debian bug tracker nor at the Ubuntu bug tracker. The LinuxPAM bug tracker is definitely the place for you to go with this, @dw. (-: