release v0.9.6: --auto no longer prompts for sudo password

sudo_runas_neg1 and sudoedit_editor's detect() bodies invoked
'sudo -ln' (intending list + non-interactive). Some sudoers / PAM
configurations have been observed prompting for a password anyway
when the flags are bundled. That meant skeletonkey --auto --i-know
could hang on a sudo password prompt during the corpus scan — bad
ergonomics for an LPE tool whose whole point is to get root without
already having it.

Fix: write '-n -l' as separate flags, redirect stdin from /dev/null
so sudo cannot fall back to reading the tty even if PAM tries to
coerce one. Belt-and-suspenders against any tty prompt during --auto.

modules/sudo_runas_neg1_cve_2019_14287/skeletonkey_modules.c

@@ -106,7 +106,9 @@ static bool get_sudo_version(const char *sudo_path, char *out, size_t outsz)
 static bool find_runas_blacklist_grant(const char *sudo_path, char *cmd_out, size_t cap)
 {
     char cmd[512];
-    snprintf(cmd, sizeof cmd, "%s -ln 2>/dev/null", sudo_path);
+    /* -n -l separated + stdin closed: see sudoedit_editor for the same
+     * pattern + rationale. `--auto` must never block on a tty prompt. */
+    snprintf(cmd, sizeof cmd, "%s -n -l </dev/null 2>/dev/null", sudo_path);
     FILE *p = popen(cmd, "r");
     if (!p) return false;
     char line[512];

modules/sudoedit_editor_cve_2023_22809/skeletonkey_modules.c

@@ -149,8 +149,13 @@ static bool get_sudo_version(const char *sudo_path, char *out, size_t outsz)
 static bool find_sudoedit_target(const char *sudo_path, char *out, size_t outsz)
 {
     char cmd[512];
-    /* -n: non-interactive (no password prompt); -l: list. */
-    snprintf(cmd, sizeof cmd, "%s -ln 2>&1", sudo_path);
+    /* -n: non-interactive (no password prompt); -l: list. The two flags
+     * are written separately and stdin is redirected from /dev/null so
+     * sudo cannot fall back to a tty prompt even if the local PAM stack
+     * tries to coerce one (some sudoers + pam_unix configurations have
+     * been observed prompting despite `-n` when the flags are bundled
+     * as `-ln`). Belt-and-suspenders so `--auto` never blocks on input. */
+    snprintf(cmd, sizeof cmd, "%s -n -l </dev/null 2>&1", sudo_path);
     FILE *p = popen(cmd, "r");
     if (!p) return false;