readpassphrase: Add readpassphraseat() function

[jfree]

Summary

Programs in Capsicum(4) capability mode are unable to open /dev/tty
causing a capability violation in readpassphrase(). Mitigate this issue
by adding readpassphraseat().

The readpassphraseat() function call takes an extra argument, ttyfd.
A pre-opened /dev/tty file descriptor may be passed in ttyfd to avoid
capability violations.

[markj]

lib/libc/gen/readpassphrase.3

106

lib/libc/gen/readpassphrase.c

64

Would it be cleaner to fall back to STDIO if a sentinel value of AT_FDCWD (or some other name for -1) is passed instead?

213

This is a bit delicate. It's possible that STDIN_FILENO is not a valid file descriptor (because it was closed by the caller for some reason), and that the above _open() call returned STDIN_FILENO. In that case, we won't close the fd here. I think it'd be better to be more explicit and use a flag variable to indicate whether we opened ttyfd or not.

214

This _close() call can clobber errno, I believe, so you'll want to save it across that call. There is some similar code already which does this using save_errno.

[jfree]

Use AT_STDIN instead of STDIN_FILENO to force read from stdin in readpassphraseat().

[jfree]

lib/libc/gen/readpassphrase.c

80

If the user passes STDIN_FILENO, STDOUT_FILENO, or STDERR_FILENO as ttyfd, this will return 0 and redirect input and output to ttyfd. To avoid this, I set the RPP_STDIN bit in flags above. I'm not sure if that is the best way to do this.