refactor: run as root via pkexec, remove sudo handling

- Add privilege escalation at startup (pkexec if not root)
- Remove all sudo password handling (echo password | sudo -S)
- Remove show_sudo_dialog and current_sudo_password_
- Remove --sudo-password CLI option
- All rsync/restore operations run directly as root
- format_size: use GB as default unit for large files
- Remove [cmd] log leaking sudo password
- Simplify snapshot_manager: no sudo_password parameter
- Simplify rsync_manager: no sudo_password parameter

src/main.cpp

@@ -6,6 +6,7 @@
 #include <ctime>
 #include <fstream>
 #include <string>
+#include <unistd.h>
 #include "config.h"
 #include "rsync_manager.h"
 #include "snapshot_manager.h"
@@ -14,6 +15,27 @@
 static FILE* log_file = nullptr;
 static bool log_to_stdout = false;
 
+static bool is_root() {
+	return getuid() == 0;
+}
+
+static void escalate_privileges(int argc, char* argv[]) {
+	if (is_root()) return;
+
+	g_print("x3-backup requires root privileges. Re-launching with pkexec...\n");
+
+	std::string cmd = "pkexec";
+	for (int i = 0; i < argc; i++) {
+		std::string arg = argv[i];
+		if (arg.find(' ') != std::string::npos)
+			cmd += " \"" + arg + "\"";
+		else
+			cmd += " " + arg;
+	}
+	int ret = system(cmd.c_str());
+	exit(ret);
+}
+
 static std::string get_log_path() {
 	const char* home = getenv("HOME");
 	if (!home) home = ".";
@@ -66,18 +88,15 @@ static void setup_logging(bool cli_mode) {
 	g_log_set_handler("x3-backup", (GLogLevelFlags)(G_LOG_LEVEL_MASK), log_handler, nullptr);
 	g_log_set_handler(nullptr, (GLogLevelFlags)(G_LOG_LEVEL_MASK), log_handler, nullptr);
 
-	g_message("=== x3-backup started ===");
+	g_message("=== x3-backup started (uid=%d) ===", getuid());
 	g_message("Log file: %s", path.c_str());
 }
 
 int main(int argc, char* argv[]) {
-	gtk_init(&argc, &argv);
-
 	bool system_mode = false;
 	bool backup_now = false;
 	bool show_help = false;
 	bool cli_mode = false;
-	std::string sudo_password;
 
 	for (int i = 1; i < argc; i++) {
 		if (strcmp(argv[i], "--system-backup") == 0) {
@@ -91,29 +110,29 @@ int main(int argc, char* argv[]) {
 			show_help = true;
 		} else if (strcmp(argv[i], "--log") == 0) {
 			log_to_stdout = true;
-		} else if (strcmp(argv[i], "--sudo-password") == 0 && i + 1 < argc) {
-			sudo_password = argv[++i];
 		}
 	}
 
-	setup_logging(cli_mode);
-
 	if (show_help) {
 		g_print("x3-Backup - GTK3 Backup/Snapshot Tool\n\n");
 		g_print("Usage: x3-backup [OPTIONS]\n\n");
 		g_print("Options:\n");
-		g_print("  --backup              Create a backup immediately and exit\n");
-		g_print("  --system-backup       Create a full system backup and exit\n");
-		g_print("  --sudo-password PW    Provide sudo password for backup (required for root permissions)\n");
-		g_print("  --log                 Print log to stdout\n");
-		g_print("  --help, -h            Show this help\n\n");
+		g_print("  --backup          Create a backup immediately and exit\n");
+		g_print("  --system-backup   Create a full system backup and exit\n");
+		g_print("  --log             Print log to stdout\n");
+		g_print("  --help, -h        Show this help\n\n");
 		g_print("Without options, x3-backup starts in GUI mode with system tray.\n\n");
-		g_print("Note: Backups require sudo to preserve file ownership and permissions.\n");
-		g_print("      Use --sudo-password or run interactively for password prompt.\n\n");
+		g_print("Note: x3-backup requires root privileges and will prompt\n");
+		g_print("      for authentication via pkexec on startup.\n\n");
 		g_print("Log file: ~/.config/x3-backup/x3-backup.log\n");
 		return 0;
 	}
 
+	escalate_privileges(argc, argv);
+	gtk_init(&argc, &argv);
+
+	setup_logging(cli_mode);
+
 	Config config;
 	config.load();
 
@@ -124,32 +143,13 @@ int main(int argc, char* argv[]) {
 			g_message("System backup mode: backing up entire system");
 		}
 
-		/* Prompt for sudo password if not provided */
-		if (sudo_password.empty()) {
-			g_print("Sudo password required for backup (to preserve file permissions):\n");
-			g_print("Password: ");
-			fflush(stdout);
-			char* pw = nullptr;
-			size_t len = 0;
-			ssize_t nread = getline(&pw, &len, stdin);
-			if (nread > 0 && pw[nread - 1] == '\n') pw[nread - 1] = '\0';
-			if (pw && *pw) {
-				sudo_password = std::string(pw);
-			}
-			free(pw);
-			if (sudo_password.empty()) {
-				g_warning("No password provided, backup may have incorrect permissions");
-			}
-		}
-
 		RsyncManager rsync(config);
 		SnapshotManager snapshots(config, rsync);
 
-		g_message("Starting backup with sudo...");
+		g_message("Starting backup...");
 		snapshots.cleanup_old_snapshots();
 		std::string ts = snapshots.create_snapshot(
-			system_mode ? "System backup" : "Manual backup",
-			sudo_password);
+			system_mode ? "System backup" : "Manual backup");
 		if (!ts.empty()) {
 			g_message("Backup completed: %s", ts.c_str());
 		} else {