Fix handling of EOF other than as caused by Ctrl-D

Author: bjorn3

src/pam/rpassword.rs

@@ -128,18 +128,11 @@ fn read_unbuffered(
         })?;
 
         if read_byte == b'\n' || read_byte == b'\r' {
-            break;
+            return Ok(password);
         }
 
         if let Hidden::Yes(input) | Hidden::WithFeedback(input) = hide_input {
             if read_byte == input.term_orig.c_cc[VEOF] {
-                if state.pw_len == 0 {
-                    // In case of Ctrl-D we don't want to ask for a password a second time, so
-                    // return an error.
-                    return Err(PamError::NeedsPassword);
-                }
-
-                password.fill(0);
                 break;
             }
 
@@ -175,7 +168,13 @@ fn read_unbuffered(
         }
     }
 
-    Ok(password)
+    if state.pw_len == 0 {
+        // In case of EOF or Ctrl-D we don't want to ask for a password a second
+        // time, so return an error.
+        return Err(PamError::NeedsPassword);
+    } else {
+        Ok(password)
+    }
 }
 
 /// Write something and immediately flush

test-framework/sudo-compliance-tests/src/su.rs

@@ -98,7 +98,7 @@ fn required_password_is_target_users_fail() {
     let diagnostic = if sudo_test::is_original_sudo() {
         "Authentication failure"
     } else {
-        "Maximum 3 incorrect authentication attempts"
+        "Authentication failed, try again."
     };
     assert_contains!(output.stderr(), diagnostic);
 }
@@ -131,7 +131,7 @@ fn password_is_required_when_target_user_is_self() {
     let diagnostic = if sudo_test::is_original_sudo() {
         "Authentication failure"
     } else {
-        "Maximum 3 incorrect authentication attempts"
+        "Password is required"
     };
     assert_contains!(output.stderr(), diagnostic);
 }

test-framework/sudo-compliance-tests/src/su/syslog.rs

@@ -85,19 +85,16 @@ fn logs_every_failed_authentication_attempt() {
 
     eprintln!("\n--- /var/log/auth.log ---\n{auth_log}\n--- /var/log/auth.log ---\n");
 
-    if sudo_test::is_original_sudo() {
-        assert_contains!(
-            auth_log,
-            format!("su: pam_unix(su:auth): auth could not identify password for [{target_user}]")
-        );
+    assert_contains!(
+        auth_log,
+        format!("su: pam_unix(su:auth): auth could not identify password for [{target_user}]")
+    );
 
+    if sudo_test::is_original_sudo() {
         let tty = "none";
         assert_contains!(
             auth_log,
             format!("FAILED SU (to {target_user}) {invoking_user} on {tty}")
         );
-    } else {
-        let tty = "";
-        assert_contains!(auth_log, format!("su: pam_unix(su:auth): authentication failure; logname= uid={invoking_userid} euid=0 tty={tty} ruser={invoking_user} rhost=  user={target_user}"));
     }
 }

test-framework/sudo-compliance-tests/src/sudo/nopasswd.rs

@@ -141,9 +141,6 @@ fn v_flag_without_pwd_fails_if_nopasswd_is_not_set_for_all_users_entries() {
             );
         }
     } else {
-        assert_contains!(
-            stderr,
-            "[sudo: authenticate] Password: \nsudo: Authentication failed, try again.\n[sudo: authenticate] Password: \nsudo: Authentication failed, try again.\n[sudo: authenticate] Password: \nsudo: Maximum 3 incorrect authentication attempts"
-        );
+        assert_contains!(stderr, "Password is required");
     }
 }

test-framework/sudo-compliance-tests/src/sudo/pass_auth/stdin.rs

@@ -34,7 +34,7 @@ fn incorrect_password() {
     let diagnostic = if sudo_test::is_original_sudo() {
         "incorrect password attempt"
     } else {
-        "incorrect authentication attempt"
+        "Authentication failed, try again."
     };
     assert_contains!(output.stderr(), diagnostic);
 }
@@ -54,7 +54,7 @@ fn no_password() {
     let diagnostic = if sudo_test::is_original_sudo() {
         "no password was provided"
     } else {
-        "incorrect authentication attempt"
+        "Password is required"
     };
     assert_contains!(output.stderr(), diagnostic);
 }

test-framework/sudo-compliance-tests/src/sudo/passwd.rs

@@ -48,6 +48,6 @@ fn explicit_passwd_overrides_nopasswd() {
     if sudo_test::is_original_sudo() {
         assert_snapshot!(stderr);
     } else {
-        assert_contains!(stderr, "Maximum 3 incorrect authentication attempts");
+        assert_contains!(stderr, "Password is required");
     }
 }

test-framework/sudo-compliance-tests/src/sudo/password_retry.rs

@@ -202,3 +202,32 @@ it could be that the image defaults to a high retry delay value; \
 you may want to increase NEW_DELAY_MICROS"
     );
 }
+
+#[test]
+fn no_password_retry_on_empty_stdin() {
+    let env = Env(format!("{USERNAME} ALL=(ALL:ALL) ALL"))
+        .user(User(USERNAME).password(PASSWORD))
+        .build();
+
+    let output = Command::new("sh")
+        .arg("-c")
+        .arg(format!("echo -n | sudo -S true"))
+        .as_user(USERNAME)
+        .output(&env);
+
+    output.assert_exit_code(1);
+
+    if sudo_test::is_original_sudo() {
+        assert_eq!(
+            output.stderr(),
+            "[sudo] password for ferris: \n\
+sudo: no password was provided\n\
+sudo: a password is required"
+        );
+    } else {
+        assert_eq!(
+            output.stderr(),
+            "[sudo: authenticate] Password: \nsudo: Password is required"
+        );
+    }
+}

test-framework/sudo-compliance-tests/src/sudo/sudoers.rs

@@ -167,7 +167,7 @@ fn user_specifications_evaluated_bottom_to_top() {
     let diagnostic = if sudo_test::is_original_sudo() {
         "no password was provided"
     } else {
-        "incorrect authentication attempt"
+        "Password is required"
     };
     assert_contains!(output.stderr(), diagnostic);
 

test-framework/sudo-compliance-tests/src/sudo/syslog.rs

@@ -39,10 +39,5 @@ fn sudo_logs_every_failed_authentication_attempt() {
     assert!(!output.status().success());
 
     let auth_log = rsyslog.auth_log();
-    let diagnostic = if sudo_test::is_original_sudo() {
-        "auth could not identify password"
-    } else {
-        "authentication failure"
-    };
-    assert_contains!(auth_log, diagnostic);
+    assert_contains!(auth_log, "auth could not identify password");
 }

test-framework/sudo-compliance-tests/src/sudo/timestamp.rs

@@ -141,7 +141,7 @@ fn cached_credential_not_shared_with_target_user_that_are_not_self() {
     let diagnostic = if sudo_test::is_original_sudo() {
         "a password is required"
     } else {
-        "Maximum 3 incorrect authentication attempts"
+        "Password is required"
     };
 
     assert_contains!(output.stderr(), diagnostic);