authd's password prompt is not shown when stdout is redirected

[adombeck]

The password prompt of su is printed to stderr, so it's also shown when stdout is redirected:

su > /dev/null
Password:

The password prompt of sudo is printed even when both stdout and stderr are redirected:

sudo ls >/dev/null 2>&1 
[sudo] password for user:

For authd users, those password prompts are not shown but instead the password prompt of the authd PAM module is shown:

sudo ls
Enter your local password:                                                                                                    
>                                                                                                                             

That password prompt is not shown when stdout is redirected:

sudo ls > /dev/null

In effect, commands like sudo ls | grep foo block without printing anything.

[shiv-tyagi]

Please assign this to me if anyone is not working on this already.

[adombeck]

@shiv-tyagi done! I think the solution might be as simple as:

diff --git a/pam/pam.go b/pam/pam.go
index 1626160b2..3bff754de 100644
--- a/pam/pam.go
+++ b/pam/pam.go
@@ -294,7 +294,7 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran
                pamClientType = adapter.InteractiveTerminal
                tty, cleanup := adapter.GetPamTTY(mTx)
                defer cleanup()
-               teaOpts = append(teaOpts, tea.WithInput(tty))
+               teaOpts = append(teaOpts, tea.WithOutput(os.Stderr), tea.WithInput(tty))
        } else {
                pamClientType = adapter.Native
                modeOpts, err := adapter.TeaHeadlessOptions()

but I didn't test it

[adombeck]

Actually, sudo's own prompt is also shown when redirecting both stdout and stderr:

sudo ls >/dev/null 2>&1 
[sudo] password for user: 

So it must do something smart like figure out that it's in a TTY and print to the stdout or stderr of the TTY. So we should first investigate that and then make a proposal how we can do something similar.

[shiv-tyagi]

Yes, you seem to be correct.

https://github.com/sudo-project/sudo/blob/ff0b6bebceec5c7d01fd296300125d51325c6ff4/src/tgetpass.c#L132
Looks like sudo opens the /dev/tty and write to it directly bypassing the stdout and stderr.

[adombeck]

Thanks for the research! We should probably do the same, to ensure that the password / authentication prompt is always visible.

[shiv-tyagi]

Looks like @3v1n0 was already working on it. Feel free to remove me as assignee. I would not have taken this if I knew already.

[adombeck]

Sorry @shiv-tyagi, I was also not aware that @3v1n0 was already working on this