Provide user custom prompts to PAM modules not using sudo PAM conversation

[3v1n0]

Describe the feature you'd like see implemented in sudo-rs

PAM Modules may or may not rely on the conversation that sudo is providing to get the user password, especially when the authentication flow is more complex or may rely on third party (UI) apps.

In such cases, if sudo -p prompt is used, the prompt is lost, because sudo exposes it only during the conversation.

What problem can be solved with this feature?

To prevent this, we could expose a SUDO_PROMPT PAM env variable where such value is shared so that modules can rely on it.

Describe alternatives you've considered

There are not many available, relying on the actual SUDO_PROMPT system env variable is possible when set, but modules should not care about system envs.

[squell]

I think this is a valid feature request, but analysing it wrt. the criteria for inclusion I am coming to the following analysis:

• wrt 1: This does open a slight extra knob to turn in a (privileged) PAM module for a caller; I think this is not a problem if we pass the module a fully expanded prompt.
• wrt 3: I am guessing the underlying problem is simply that if a user has some extra info in their SUDO_PROMPT, it would be nice to show it to them in e.g. their fingerprint reader popup? I.e. this makes the world slightly nicer.
• wrt 4: Since this is not in ogsudo as well, it's not a common use case at present; but if ogsudo would adopt this feature I think that would be a good argument to consider taking it. And the criteria were of course not meant to stifle innnovation.

We still need to discuss this with the full team.