Parse `--debug` parameter before forking

[raboof]

To make sure the pw backend picks up the loglevel when passing --debug.

[emersion]

This has security implications: it executes more code as root. In particular, with this patch, files are opened as root.

[raboof]

ah, using pam here, indeed I didn't notice this is the case for the shadow backend :thinking:

[raboof]

OK, so:

• we do want a way to enable debug logging of the backend (right?)
• we don't want to open files before dropping privileges
• we don't want to change the logic of first processing the config file and then processing the CLI parameters
• we don't want to introduce unnecessary changes in the way the pam and shadow backends need to be invoked
• we don't want to introduce other mechanisms (such as setting environment variables) to enable debugging, as that'd be inconsistent with related tools like sway itself

Perhaps we could have the forked process look for the --debug flag itself, ignoring any other flags and the config file? Somewhat inconsistent and not very DRY, but possibly acceptable since '--debug' is a somewhat 'special' diagnostic flag anyway? WDYT?

[emersion]

Yeah that sounds reasonable!

[emersion]

Hm, unfortunately this is not quite enough. swayidle -- --debug for instance processes --debug as an argument, not an option.

Can we use getopt to parse --debug?

[raboof]

Can we use getopt to parse --debug?

updated

[emersion]

We need to reset optind = 1 to allow getopt to be called multiple times.

[emersion]

Hm, we need to reset optind = 1 between the two getopt loops, ie. after the log_init call.

[raboof]

We need to reset optind = 1 to allow getopt to be called multiple times.

Gotcha! Can confirm this indeed makes cases where --debug isn't the first parameter work :laughing: . Apologies for not testing sufficiently...

[raboof]

Hm, we need to reset optind = 1 between the two getopt loops, ie. after the log_init call.

That was already the case (parse_options set optind = 1 before entering the loop that calls getopt_long). TBH this is pretty surprising API to me, but also setting optind = 1 before entering the loop in log_init as well did improve behavior :thinking:

[raboof]

Thanks for the thorough review!