Add expose_authtok option to pam_exec(8).

[munro_ip9.org]

Summary

For compatibility with Linux PAM's pam_exec module, allow the password to be optionally passed to the executed program's stdin.

Test Plan

Install "pamtester" from pkg/ports.

Create an executable script my_script.sh containing:

#!/bin/sh
read password
if [ "$PAM_USER" == "abc" ] && [ "$password" == "123" ] ; then
  exit 0
else
  exit 1
fi

Create /etc/pam.d/my-service containing:

auth required /path/to/pam_exec.so expose_authtok /path/to/my_script.sh
account required pam_permit.so

Now run:

pamtester my-service abc authenticate

It waits for a password; entering "123" succeeds, anything else fails.

[munro_ip9.org]

Added handling for EAGAIN on write() (not sure if that case is reachable).

[munro_ip9.org]

Thanks!