x/term: "Access is denied." error with ReadPassword on Windows

[codesoap]

What version of Go are you using (go version)?

$ go version
go version go1.16.2 openbsd/amd64

Does this issue reproduce with the latest release?

It reproduces with the latest version of x/term (v0.0.0-20210503060354-a79de5458b56).

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/fooman/.cache/go-build"
GOENV="/home/fooman/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="openbsd"
GOINSECURE=""
GOMODCACHE="/home/fooman/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="openbsd"
GOPATH="/home/fooman/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/openbsd_amd64"
GOVCS=""
GOVERSION="go1.16.2"
GCCGO="gccgo"
AR="ar"
CC="cc"
CXX="c++"
CGO_ENABLED="1"
GOMOD="/home/fooman/tmp_1m/readpw_win/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3256633254=/tmp/go-build -gno-record-gcc-switches"

I'm cross compiling from OpenBSD for Windows.

What did you do?

I ran the following program on the Windows 10 operating system:

package main

import (
	"fmt"
	"golang.org/x/term"
	"os"
)

func main() {
	tty, err := os.Open("CON:")
	if err != nil {
		panic(err)
	}
	defer tty.Close()
	pw, err := term.ReadPassword(int(tty.Fd()))
	if err != nil {
		panic(err)
	}
	fmt.Println(string(pw))
}

What did you expect to see?

I expected the program to prompt me for password input and to then print the entered password.

What did you see instead?

When running the program (either as normal user or as administator) I get this output:

panic: Access is denied.

goroutine 1 [running]:
main.main()
        /home/fooman/tmp_1m/readpw_win/readpw_win.go:17 +0x197

[heschi]

cc @tklauser @ianlancetaylor

[networkimprov]

cc @alexbrainman @mattn @zx2c4

@gopherbot add OS-Windows

[alexbrainman]

@codesoap your version of the code is not expected to work.

Try using https://pkg.go.dev/golang.org/x/term#Terminal.ReadPassword on Windows.

Alex

[codesoap]

@alexbrainman Thanks for your response. I now tried using https://pkg.go.dev/golang.org/x/term#Terminal.ReadPassword:

package main

import (
	"fmt"
	"golang.org/x/term"
	"os"
)

func main() {
	fmt.Println(getPw())
}

func getPw() string {
	tty, err := os.Open("CON:")
	if err != nil {
		panic(err)
	}
	defer tty.Close()
	oldState, err := term.MakeRaw(int(tty.Fd()))
	if err != nil {
		panic(err)
	}
	defer term.Restore(int(tty.Fd()), oldState)
	terminal := term.NewTerminal(tty, "")
	pw, err := terminal.ReadPassword("")
	if err != nil {
		panic(err)
	}
	return string(pw)
}

This time using the MakeRaw function failed (same result for normal user and administrator):

panic: Access is denied.

goroutine 1 [running]:
main.getPw(0x0, 0x0)
        /home/fooman/tmp_1m/readpw_win/readpw_win.go:21 +0x2e5
main.main()
        /home/fooman/tmp_1m/readpw_win/readpw_win.go:10 +0x29

If I leave out the call of MakeRaw, the program does not panic, but the input is echoed while typing.

[alexbrainman]

@codesoap sorry for confusing you. It has been many years since I looked at this code.

Here is your original version with small mod:

package main

import (
        "fmt"
        "golang.org/x/term"
        "os"
)

func main() {
        pw, err := term.ReadPassword(int(os.Stdin.Fd()))
        if err != nil {
                panic(err)
        }
        fmt.Println(string(pw))
}

Here is this program in action:

Z:\>test
hello world

Z:\>

I typed hello world and then pressed enter key as it runs.

I hope it helps.

Alex

[codesoap]

I probably didn't describe my problem in enough detail. I'm intentionally not using os.Stdin, because in my case standard input is not the terminal, but a pipe. To be more specific: I'm talking about https://github.com/FiloSottile/age, which can take encrypted data via a pipe/standard input and will then prompt the user for a password via the terminal (which is not standard input).

Using /dev/tty on UNIX-like systems works flawlessly in this scenario, but using CON: on Windows does not. It is, hovewer, entirely possible, that I misunderstood the purpose of the CON: device on Windows.

[alexbrainman]

Using /dev/tty on UNIX-like systems works flawlessly in this scenario, but using CON: on Windows does not. It is, hovewer, entirely possible, that I misunderstood the purpose of the CON: device on Windows.

I am not familiar with https://github.com/FiloSottile/age package. Can you provide a small piece of code that works on UNIX and does not work on Windows? Hopefully this will help me understand what you are trying to achieve.

Thank you.

Alex

[codesoap]

Thanks a lot for keeping at it! I hope this program clarifies what I'm trying to achieve. It works on UNIX-like systems, but does not work on Windows after substituting /dev/tty for CON::

package main

import (
	"fmt"
	"golang.org/x/term"
	"io"
	"os"
)

func main() {
	tty, err := os.Open("/dev/tty")
	if err != nil {
		panic(err)
	}
	defer tty.Close()
	fmt.Print("Enter password: ")
	pw, err := term.ReadPassword(int(tty.Fd()))
	if err != nil {
		panic(err)
	}
	fmt.Println("")
	decryptStdin(string(pw))
}

// decryptStdin is only a dummy, which prints what was received via
// standard input. In the real world it would use pw to decrypt the
// standard input before printing it.
func decryptStdin(pw string) {
	fmt.Println("Decrypted message:")
	io.Copy(os.Stdout, os.Stdin)
}

This is how I can use the program on a UNIX-like system; I am prompted to enter the password interactively:

$ echo foo | ./readpw
Enter password:
Decrypted message:
foo

[alexbrainman]

It works on UNIX-like systems, but does not work on Windows after substituting /dev/tty for CON::

I tried it too, I get Access is denied. just like you did. The error is from SetConsoleMode Windows API. os.Open uses CreateFile Windows API to open the file. Perhaps some CreateFile parameters are set wrong when os.Open is called.

But regardless, you are using 3 different devices in your program: /dev/tty, stdin and stdout. You won't be able to do that on Windows. On Windows you can read and write from console device - that is it. There is only one console input device. If you use SetConsoleMode to adjust console parameters (that is what ReadPassword does), then your console parameters change for any IO.

Alex

[networkimprov]

@codesoap does this help?
https://docs.microsoft.com/en-us/windows/console/console-handles

You might also want to raise your Q on StackOverflow or golang-nuts for more ideas...

[codesoap]

@networkimprov Thanks for the input, but I'm not sure if this is relevant to my problem, since I have no problem with stdin (term.ReadPassword works flawlessly with stdin on Windows). However, I'm also utterly unfamiliar with Windows and it's APIs, so maybe I just don't see how the linked article could help me...

@alexbrainman:

But regardless, you are using 3 different devices in your program: /dev/tty, stdin and stdout. You won't be able to do that on Windows.

I'm not sure if I understood you correctly, but using 3 different devices in the same program definitely works on Windows. If I modify my last provided program to use fmt.Fscanln instead of term.ReadPassword it works as expected:

package main

import (
	"fmt"
	"io"
	"os"
)

func main() {
	tty, err := os.Open("CON:")
	if err != nil {
		panic(err)
	}
	defer tty.Close()
	fmt.Print("Enter password: ")
	var pw string
	_, err = fmt.Fscanln(tty, &pw)
	if err != nil {
		panic(err)
	}
	decryptStdin(pw)
}

// decryptStdin is only a dummy, which prints what was received via
// standard input. In the real world it would use pw to decrypt the
// standard input before printing it.
func decryptStdin(pw string) {
	fmt.Println("Decrypted message:")
	io.Copy(os.Stdout, os.Stdin)
}

This is what I get (on Windows):

> echo foo | readpw.exe
Enter password: bar
Decrypted message:
foo