`fscrypt unlock </dev/null` hangs indefinitely

[jyn514]

Steps to reproduce:

1. Create a directory managed by fscrypt
2. Run fscrypt unlock DIR </dev/null

I expect that this exits with an error, because it's never going to get a password (ideally it would say that it's unable to read stdin). Instead, it loops forever until canceled:

Enter login passphrase for jyn: Incorrect Passphrase
Enter login passphrase for jyn: Incorrect Passphrase
Enter login passphrase for jyn: Incorrect Passphrase
Enter login passphrase for jyn: Incorrect Passphrase
...

This bit me originally because I put fscrypt unlock in /etc/ssh/sshrc, so it completely locked me out of my machine until I was able to get physical access to it.

[jyn514]

there are two bugs here:

1. unwrapProtectorKey should have a limit on the number of passphrase attempts (maybe 3 is reasonable, to match sudo?):

   fscrypt/actions/callback.go

   Lines 83 to 106 in 5980fd9

   	// unwrapProtectorKey uses the provided callback and ProtectorInfo to return
   	// the unwrapped protector key. This will repeatedly call keyFn to get the
   	// wrapping key until the correct key is returned by the callback or the
   	// callback returns an error.
   	func unwrapProtectorKey(info ProtectorInfo, keyFn KeyFunc) (*crypto.Key, error) {
   	retry := false
   	for {
   	wrappingKey, err := getWrappingKey(info, keyFn, retry)
   	if err != nil {
   	return nil, err
   	}
   	protectorKey, err := crypto.Unwrap(wrappingKey, info.data.WrappedKey)
   	wrappingKey.Wipe()
   	switch errors.Cause(err) {
   	case nil:
   	log.Printf("valid wrapping key for protector %s", info.Descriptor())
   	return protectorKey, nil
   	case crypto.ErrBadAuth:
   	// After the first failure, we let the callback know we are retrying.
   	log.Printf("invalid wrapping key for protector %s", info.Descriptor())
   	retry = true
   	continue

2. passphraseReader.Read should notice that it is not getting any input from stdin and return an error:

   fscrypt/cmd/fscrypt/keys.go

   Lines 59 to 84 in 5980fd9

   	// Read gets input from the terminal until a newline is encountered or the given
   	// buffer is full.
   	func (p passphraseReader) Read(buf []byte) (int, error) {
   	// We read one byte at a time to handle backspaces
   	position := 0
   	for {
   	if position == len(buf) {
   	return position, nil
   	}
   	if _, err := io.ReadFull(os.Stdin, buf[position:position+1]); err != nil {
   	return position, err
   	}
   	switch buf[position] {
   	case '\r', '\n':
   	return position, io.EOF
   	case 3, 4:
   	return position, ErrCanceled
   	case 8, 127:
   	if position > 0 {
   	position--
   	}
   	default:
   	position++
   	}
   	}
   	}