There are a number of cases where we use frecon to display information to the user:

display_boot_message: https://chromium.googlesource.com/chromiumos/platform/assets/+/master/text/display_boot_message#144
recovery/messages.sh: https://chromium.googlesource.com/chromiumos/platform/initramfs/+/master/recovery/messages.sh#249
init/boot-splash.conf: https://chromium.googlesource.com/chromiumos/platform2/+/master/init/boot-splash.conf#62
display_low_battery_alert: https://chromium.googlesource.com/chromiumos/platform2/+/master/init/display_low_battery_alert#43

There are some more occurrences in the factory code, but I don't think we care about these from the UX and security perspective :-D

Currently, frecon will accept keyboard input even when used in the contexts listed above, echoing back the characters on the terminal. This is (1) a slight UX issue and (2) a slight security concern since we're parsing untrusted user input where there is no reason to do so while we're running as root. Note that this is likely hard to exploit since there's no shell attached (but if you have a bug in libpng, that'd make a nice exploit via the image escape sequences! definitely risky for recovery). Since we aren't actually interested in processing user input, it's preferable to just avoid the risk entirely.

We should likely add a flag to frecon that tells it to ignore user input. Frecon code can just skip initializing its input subsystem when the flag is present.

Then, we should update all the contexts mentioned above to pass the flag.