pam: Always Honor PAM_TTY if set

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/charmbracelet/bubbles v0.20.0
 	github.com/charmbracelet/bubbletea v1.2.4
 	github.com/charmbracelet/lipgloss v1.0.0
+	github.com/charmbracelet/x/term v0.2.1
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/godbus/dbus/v5 v5.1.0
 	github.com/google/uuid v1.6.0
@@ -33,7 +34,6 @@ require (
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/charmbracelet/x/ansi v0.4.5 // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect

pam/internal/adapter/nativemodel.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"math"
 	"os"
 	"slices"
 	"strconv"
@@ -22,7 +21,6 @@ import (
 	"github.com/ubuntu/authd/log"
 	"github.com/ubuntu/authd/pam/internal/proto"
 	pam_proto "github.com/ubuntu/authd/pam/internal/proto"
-	"golang.org/x/term"
 )
 
 type nativeModel struct {
@@ -90,7 +88,7 @@ func (m *nativeModel) Init() tea.Cmd {
 		log.Errorf(context.TODO(), "failed to get the PAM service: %v", err)
 	}
 
-	m.interactive = isSSHSession(m.pamMTx) || m.isTerminalTty()
+	m.interactive = isSSHSession(m.pamMTx) || IsTerminalTTY(m.pamMTx)
 	rendersQrCode := m.isQrcodeRenderingSupported()
 
 	return func() tea.Msg {
@@ -663,41 +661,6 @@ func (m nativeModel) promptForChallenge(prompt string) (string, error) {
 	}
 }
 
-func (m nativeModel) getPamTty() (*os.File, error) {
-	pamTty, err := m.pamMTx.GetItem(pam.Tty)
-	if err != nil {
-		return nil, err
-	}
-
-	if pamTty == "" {
-		return nil, errors.New("no PAM_TTY value set")
-	}
-
-	f, err := os.OpenFile(pamTty, os.O_RDWR, 0600)
-	if err != nil {
-		return nil, err
-	}
-
-	return f, nil
-}
-
-func (m nativeModel) isTerminalTty() bool {
-	tty, err := m.getPamTty()
-	// We check the fd could be passed to x/term to decide if we should fallback to stdin
-	if err == nil {
-		defer tty.Close()
-		if tty.Fd() > math.MaxInt {
-			err = fmt.Errorf("unexpected large PAM TTY fd: %d", tty.Fd())
-		}
-	}
-	if err != nil {
-		log.Debugf(context.TODO(), "Failed to open PAM TTY: %s", err)
-		tty = os.Stdin
-	}
-
-	return term.IsTerminal(int(tty.Fd()))
-}
-
 func (m nativeModel) renderQrCode(qrCode *qrcode.QRCode) (qr string) {
 	defer func() { qr = strings.TrimRight(qr, "\n") }()
 
@@ -782,7 +745,7 @@ func (m nativeModel) isQrcodeRenderingSupported() bool {
 		if isSSHSession(m.pamMTx) {
 			return false
 		}
-		return m.isTerminalTty()
+		return IsTerminalTTY(m.pamMTx)
 	}
 }
 

pam/internal/adapter/utils.go

@@ -1,17 +1,25 @@
 package adapter
 
 import (
+	"context"
 	"errors"
+	"fmt"
+	"math"
 	"os"
 	"sync"
 
 	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/x/term"
 	"github.com/msteinert/pam/v2"
+	"github.com/ubuntu/authd/log"
 )
 
 var (
 	isSSHSessionValue bool
 	isSSHSessionOnce  sync.Once
+
+	isTerminalTtyValue bool
+	isTerminalTtyOnce  sync.Once
 )
 
 // convertTo converts an interface I value to T. It will panic (progamming error) if this is not the case.
@@ -65,6 +73,59 @@ func isSSHSession(mTx pam.ModuleTransaction) bool {
 	return isSSHSessionValue
 }
 
+// GetPamTty returns the file to that is used by PAM tty or stdin.
+func GetPamTty(mTx pam.ModuleTransaction) (tty *os.File, cleanup func()) {
+	var err error
+	defer func() {
+		if err != nil {
+			log.Warningf(context.TODO(), "Failed to open PAM TTY: %s", err)
+		}
+		if tty == nil {
+			tty = os.Stdin
+		}
+		if cleanup == nil {
+			cleanup = func() {}
+		}
+	}()
+
+	var pamTty string
+	pamTty, err = mTx.GetItem(pam.Tty)
+	if errors.Is(err, pam.ErrBadItem) {
+		err = nil
+	}
+	if err != nil {
+		return nil, nil
+	}
+
+	if pamTty == "" {
+		return nil, nil
+	}
+
+	tty, err = os.OpenFile(pamTty, os.O_RDWR, 0600)
+	if err != nil {
+		return nil, nil
+	}
+	cleanup = func() { tty.Close() }
+
+	// We check the fd could be passed to x/term to decide if we should fallback to stdin
+	if tty.Fd() > math.MaxInt {
+		err = fmt.Errorf("unexpected large PAM TTY fd: %d", tty.Fd())
+		return nil, cleanup
+	}
+
+	return tty, cleanup
+}
+
+// IsTerminalTTY returns whether the [pam.Tty] or the [os.Stdin] is a terminal TTY.
+func IsTerminalTTY(mTx pam.ModuleTransaction) bool {
+	isTerminalTtyOnce.Do(func() {
+		tty, cleanup := GetPamTty(mTx)
+		defer cleanup()
+		isTerminalTtyValue = term.IsTerminal(tty.Fd())
+	})
+	return isTerminalTtyValue
+}
+
 func maybeSendPamError(err error) tea.Cmd {
 	if err == nil {
 		return nil

pam/pam.go

@@ -24,7 +24,6 @@ import (
 	"github.com/ubuntu/authd/log"
 	"github.com/ubuntu/authd/pam/internal/adapter"
 	"github.com/ubuntu/authd/pam/internal/gdm"
-	"golang.org/x/term"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
@@ -123,7 +122,7 @@ func sendReturnMessageToPam(mTx pam.ModuleTransaction, retStatus adapter.PamRetu
 // initLogging initializes the logging given the passed parameters.
 // It returns a function that should be called in order to reset the logging to
 // the default and potentially close the opened resources.
-func initLogging(args map[string]string, flags pam.Flags) (func(), error) {
+func initLogging(mTx pam.ModuleTransaction, args map[string]string, flags pam.Flags) (func(), error) {
 	log.SetLevel(log.InfoLevel)
 	resetFunc := func() {}
 	if args["debug"] == "true" {
@@ -163,7 +162,7 @@ func initLogging(args map[string]string, flags pam.Flags) (func(), error) {
 		if log.IsLevelEnabled(log.DebugLevel) {
 			return
 		}
-		if term.IsTerminal(int(os.Stdin.Fd())) {
+		if adapter.IsTerminalTTY(mTx) {
 			return
 		}
 		log.SetLevel(log.WarnLevel)
@@ -226,7 +225,7 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran
 	var pamClientType adapter.PamClientType
 	var teaOpts []tea.ProgramOption
 
-	closeLogging, err := initLogging(parsedArgs, flags)
+	closeLogging, err := initLogging(mTx, parsedArgs, flags)
 	defer func() {
 		log.Debugf(context.TODO(), "%s: exiting with error %v", mode, err)
 
@@ -291,8 +290,11 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran
 			return fmt.Errorf("%w: can't create tea options: %w", pam.ErrSystem, err)
 		}
 		teaOpts = append(teaOpts, modeOpts...)
-	} else if !forceNativeClient && term.IsTerminal(int(os.Stdin.Fd())) {
+	} else if !forceNativeClient && adapter.IsTerminalTTY(mTx) {
 		pamClientType = adapter.InteractiveTerminal
+		tty, cleanup := adapter.GetPamTty(mTx)
+		defer cleanup()
+		teaOpts = append(teaOpts, tea.WithInput(tty))
 	} else {
 		pamClientType = adapter.Native
 		modeOpts, err := adapter.TeaHeadlessOptions()
@@ -349,7 +351,7 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran
 // AcctMgmt sets any used brokerID as default for the user.
 func (h *pamModule) AcctMgmt(mTx pam.ModuleTransaction, flags pam.Flags, args []string) (err error) {
 	parsedArgs, logArgsIssues := parseArgs(args)
-	closeLogging, err := initLogging(parsedArgs, flags)
+	closeLogging, err := initLogging(mTx, parsedArgs, flags)
 	defer closeLogging()
 	defer func() {
 		log.Debugf(context.TODO(), "AcctMgmt: exiting with error %v", err)