From 63e5731817220198b11f3caafe19c9622757b2c6 Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Fri, 21 Aug 2026 13:26:19 +0200
Subject: [PATCH 1/2] feat: use systemd-journal-logger when running as systemd
 service

This produces nicer logging output with colors for log levels and no
duplicate time stamps.
---
 Cargo.lock               | 13 ++++++++++++-
 Cargo.toml               |  1 +
 cmd/passless/Cargo.toml  |  1 +
 cmd/passless/src/main.rs | 22 +++++++++++++++-------
 4 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index afa871ac..3a37f61c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1789,6 +1789,7 @@ dependencies = [
  "soft-fido2",
  "soft-fido2-ctap",
  "soft-fido2-transport",
+ "systemd-journal-logger",
  "tempfile",
  "tokio",
  "toml",
@@ -2619,6 +2620,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "systemd-journal-logger"
+version = "2.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7266304d24ca5a4b230545fc558c80e18bd3e1d2eb1be149b6bcd04398d3e79c"
+dependencies = [
+ "log",
+ "rustix",
+]
+
 [[package]]
 name = "target-lexicon"
 version = "0.12.16"
@@ -2644,7 +2655,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
diff --git a/Cargo.toml b/Cargo.toml
index df45f5d3..e0921d6a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -32,6 +32,7 @@ clap-serde-derive = "0.2"
 clap_complete = "4.5"
 log = "0.4"
 env_logger = "0.11"
+systemd-journal-logger = "2.2.2"
 sha2 = "0.11"
 serde_cbor = "0.11.2"
 serde = { version = "1.0.228", features = ["derive"] }
diff --git a/cmd/passless/Cargo.toml b/cmd/passless/Cargo.toml
index 47610d21..2f5d150d 100644
--- a/cmd/passless/Cargo.toml
+++ b/cmd/passless/Cargo.toml
@@ -34,6 +34,7 @@ soft-fido2-transport.workspace = true
 soft-fido2-ctap.workspace = true
 log.workspace = true
 env_logger.workspace = true
+systemd-journal-logger.workspace = true
 sha2.workspace = true
 serde_cbor.workspace = true
 serde.workspace = true
diff --git a/cmd/passless/src/main.rs b/cmd/passless/src/main.rs
index 2c35b3cb..7279c896 100644
--- a/cmd/passless/src/main.rs
+++ b/cmd/passless/src/main.rs
@@ -432,13 +432,21 @@ fn run() -> Result<()> {
         log::LevelFilter::Info
     };
 
-    let env = Env::default()
-        .filter("PASSLESS_LOG_LEVEL")
-        .write_style("PASSLESS_LOG_STYLE");
-    Builder::from_env(env)
-        .filter_level(log::LevelFilter::Debug)
-        .format_timestamp_millis()
-        .init();
+    if systemd_journal_logger::connected_to_journal() {
+        systemd_journal_logger::JournalLog::new()
+            .unwrap()
+            .with_syslog_identifier("passless".to_string())
+            .install()
+            .unwrap();
+    } else {
+        let env = Env::default()
+            .filter("PASSLESS_LOG_LEVEL")
+            .write_style("PASSLESS_LOG_STYLE");
+        Builder::from_env(env)
+            .filter_level(log::LevelFilter::Debug)
+            .format_timestamp_millis()
+            .init();
+    }
     log::set_max_level(log_level);
 
     // Load config: CLI args + config file + defaults (CLI takes precedence)

From d9c3f20837532ba7a1fadb21e61f6b27016925d3 Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Sat, 22 Aug 2026 12:00:40 +0200
Subject: [PATCH 2/2] fix: address review

---
 Cargo.toml               |  2 +-
 cmd/passless/src/main.rs | 18 +++++++++++++-----
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index e0921d6a..395d4141 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -41,7 +41,7 @@ dirs = "6.0"
 prs-lib = "0.5"
 serde_json = "1.0"
 libc = "0.2"
-nix = { version = "0.31", features = ["resource", "fs", "signal", "process", "dir"] }
+nix = { version = "0.31", features = ["resource", "fs", "signal", "process", "dir", "user"] }
 notify-rust = "4.11"
 aes-gcm = "0.11"
 rand = "0.8"
diff --git a/cmd/passless/src/main.rs b/cmd/passless/src/main.rs
index 7279c896..6801f396 100644
--- a/cmd/passless/src/main.rs
+++ b/cmd/passless/src/main.rs
@@ -432,12 +432,20 @@ fn run() -> Result<()> {
         log::LevelFilter::Info
     };
 
-    if systemd_journal_logger::connected_to_journal() {
-        systemd_journal_logger::JournalLog::new()
-            .unwrap()
-            .with_syslog_identifier("passless".to_string())
+    // Use syslog when running as systemd service
+    if systemd_journal_logger::connected_to_journal()
+        && let Ok(journal) = systemd_journal_logger::JournalLog::new()
+    {
+        // Assume only the agent is run as root
+        let syslog_identifier = if nix::unistd::Uid::effective().is_root() {
+            "passless-agent"
+        } else {
+            "passless"
+        };
+        journal
+            .with_syslog_identifier(syslog_identifier.to_string())
             .install()
-            .unwrap();
+            .expect("Logger was already installed.");
     } else {
         let env = Env::default()
             .filter("PASSLESS_LOG_LEVEL")