If a client incorrectly communicates with the session worker, then it's
possible for plaintext passwords to be displayed.

This error appeared for me when I was testing tuigreet with
fprintd-grosshack, which in some situations seems to cause the greeter
to incorrectly return a "PamResponse" when the worker expects a response
in the form of either "Args" or "Cancel". Since unexpected messages are
returned as an error using the format! macro, this returns an error
message that directly exposes the user's password in plaintext.

On a vt switch, greetd always redirects stdout and stderr to the new vt.
On graphical sessions this means that the output ends up under the
framebuffer, mostly inaccessible without some slightly awkward shell
redirections in the session command.

I would like to suggest the addition of a flag that persists the stdout
and stderr of the parent process, so output can more easily be captured
and redirected to logfiles. I have managed to patch my own local version
of greetd to allow this behavior, and I'm more than happy to submit this
patch if there's agreement that this feature is welcome. Although this
patch is a little messy as it has to pass a boolean between every
function in the path from initializing the config to spawning processes.
Which leads me to wonder if the current config handling should be
replaced with a lazily-evaluated static.