terminal line settings are not reset if SIGINT is received while waiting for pam plugin

[71rd]

When sudo is configured to use a pam module like pam_agent_auth trying to abort with CTRL-C(/SIGINT) sudo before the pam module returns, will break terminals. As line settings are not reset back to their original state potentially requiring the terminal to be restarted to use it again or settings to be reset in extra command if still possible.

The time window for that is generally short, but if the pam module requires interactive authentication, like physical touch for presence detection, it becomes much more likely for this to be triggered.

Further sudo wont early anyway, waiting for the authentication to timeout or succeed before finally failing.

Environment

Operating System: Nixos 24.11
Sudo version: 1.1.15p5
terminal and shell: kitty+zsh, also reproduced using different shells and terminals.

Reproduce

• use ssh-key that requires interactive authentication (password protected/yubikey/etc)
• Add pam module like pam_agent_auth to /etc/pam.d/sudo
  auth sufficient pam_ssh_agent_auth.so file=/etc/ssh/authorized_keys.d/%u
• add ssh key to for user to directory
• ensure user is in sudoers file
• open new shell and check terminal line settings with stty -a
• execute command with sudo in that shell
• press CTRL-C
• wait for sudo to return
• execute 'tty -a again and compare to before. some settings will be changed and terminal might be broken