Pass the app's log level into the elevated run

client/internal/daemonaddr/identity.go

@@ -4,11 +4,14 @@ import "strings"
 
 // CarriesIdentity reports whether the control channel at addr conveys the
 // connecting process's identity to the daemon. A Unix socket carries peer
-// credentials and a named pipe carries the client's token; loopback TCP carries
-// neither, so on such an address the daemon cannot authorize a privileged
-// operation for anybody. A client uses this to tell whether becoming privileged
-// would get it anywhere: on an identity-less address it would not, and the only
-// way forward is to move the daemon onto one that carries identity.
+// credentials and a named pipe carries the client's token. Nothing else does, TCP
+// included, and there the daemon can authorize a privileged operation for nobody
+// at all: see ResolveDaemonAddr, which says as much to anyone still reaching the
+// Windows daemon on the address it served before it had a pipe.
+//
+// A client uses this to tell whether becoming privileged would get it anywhere.
+// It answers from the scheme and nothing else, so an address it does not
+// recognise counts as carrying no identity.
 func CarriesIdentity(addr string) bool {
 	return strings.HasPrefix(addr, "unix://") || strings.HasPrefix(addr, pipeScheme)
 }

client/ui/services/guarded.go

@@ -126,11 +126,16 @@ func (s *Settings) SetGuardedSettings(ctx context.Context, p GuardedSettings) (S
 		}
 	}
 
+	// The elevated run has no window and, on Linux, an environment pkexec has
+	// cleared, so what it writes to stderr is all there is to go on. It follows
+	// this process's level so that starting the app with --log-level debug says
+	// something about the run behind the prompt too.
 	args := append([]string{
 		"--" + FlagApplyPrivilegedSettings,
 		"--" + FlagDaemonAddr, s.daemonAddr,
 		"--" + FlagProfile, p.ProfileName,
 		"--" + FlagUser, p.Username,
+		"--" + FlagLogLevel, log.GetLevel().String(),
 	}, oneShotArgs(settings)...)
 
 	ctx, cancel := context.WithTimeout(ctx, elevationTimeout)

client/ui/services/guarded_test.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"testing"
 
+	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/genproto/googleapis/rpc/errdetails"
@@ -129,10 +130,15 @@ func TestSetGuardedSettingsPassesOnlyTheChangedSettings(t *testing.T) {
 		"--" + FlagDaemonAddr, testDaemonAddr,
 		"--" + FlagProfile, "work",
 		"--" + FlagUser, "vma",
+		"--" + FlagLogLevel, log.GetLevel().String(),
 		"--" + FlagEnableSSHRoot + "=true",
 	}
 	require.Len(t, elev.calls, 1, "one prompt for one change")
 	assert.Equal(t, want, elev.calls[0], "elevated arguments")
+
+	// argv[1] is what the polkit action is pinned to, so the marker has to stay
+	// first however the rest of the line grows.
+	assert.Equal(t, "--"+FlagApplyPrivilegedSettings, elev.calls[0][0], "the flag polkit matches on")
 }
 
 // Turning a setting off has to be as explicit as turning it on: a bare flag would