Spurious failure of sudo::pass_auth::tty::correct_password

[bjorn3]

I got this locally on 37139a3:

---- sudo::pass_auth::tty::correct_password stdout ----

thread 'sudo::pass_auth::tty::correct_password' (1319995) panicked at sudo-compliance-tests/src/sudo/pass_auth/tty.rs:17:10:
program failed with exit status: 5
stdout:


stderr:

stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb/library/std/src/panicking.rs:698:5
   1: core::panicking::panic_fmt
             at /rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb/library/core/src/panicking.rs:75:14
   2: sudo_test::docker::command::Output::assert_success
             at /home/bjorn/Projects/sudo-rs/test-framework/sudo-test/src/docker/command.rs:167:13
   3: sudo_compliance_tests::sudo::pass_auth::tty::correct_password
             at ./src/sudo/pass_auth/tty.rs:17:10
   4: sudo_compliance_tests::sudo::pass_auth::tty::correct_password::{{closure}}
             at ./src/sudo/pass_auth/tty.rs:8:22
   5: core::ops::function::FnOnce::call_once
             at /home/bjorn/.rustup/toolchains/stable-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/ops/function.rs:250:5
   6: core::ops::function::FnOnce::call_once
             at /rustc/ed61e7d7e242494fb7057f2657300d9e77bb4fcb/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

[bjorn3]

Happened again locally. According to the man page, sshpass exits with exit code 5 when the password is incorrect, which it seems to detect by seeing password in the output of sudo-rs twice: https://sourceforge.net/p/sshpass/code-git/ci/main/tree/main.c#l476

[squell]

Happened again locally. According to the man page, sshpass exits with exit code 5 when the password is incorrect, which it seems to detect by seeing password in the output of sudo-rs twice: https://sourceforge.net/p/sshpass/code-git/ci/main/tree/main.c#l476

🙈 The amount of software in this world that relies on a regex in sudo that detects "Password:" only to replace it with a nicer looking "[sudo] password for %user:" is baffling.

We can run the test case with sudo --prompt password.

[bjorn3]

Askpass should look for "assword" (missing the leading "p" to match both "Password" and "password") anywhere in the output. Although maybe the issue is that we don't use a single atomic write for the whole prompt. It looks like sshpass doesn't accumulate an input buffer between multiple reads, so if the "assword" substring got split over two reads it would fail.

[bjorn3]

Although maybe the issue is that we don't use a single atomic write for the whole prompt.

Never mind. We do actually use a single atomic write after all.

sudo-rs/src/pam/rpassword.rs

Line 323 in 6f6c909

write_unbuffered(file, prompt.as_bytes())?;

Or maybe the pipe got full enough for some reason that this write had to be split in two?