nss-util: Add support for $SYSTEMD_NSS_LOG_LEVEL

When setting SYSTEMD_LOG_LEVEL=debug and debugging a tool that happens
to do NSS lookups, the resulting logs from varlink are obnoxiously
verbose. Let's parse a separate log level environment variable in NSS
to allow overriding the log level for NSS specifically so these noisy
logs can be silenced.

docs/ENVIRONMENT.md

@@ -289,6 +289,9 @@ All tools:
   user/group records for dynamically registered service users (i.e. users
   registered through `DynamicUser=1`).
 
+* `$SYSTEMD_NSS_LOG_LEVEL=<level>` — If set, sets the log level for `nss-systemd`
+  and other NSS plugins specifically. Takes priority over `$SYSTEMD_LOG_LEVEL`.
+
 `systemd-timedated`:
 
 * `$SYSTEMD_TIMEDATED_NTP_SERVICES=…` — colon-separated list of unit names of

src/shared/nss-util.c

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include <pthread.h>
+#include <stdlib.h>
 
 #include "sd-json.h"
 
@@ -12,8 +13,21 @@
 sd_json_dispatch_flags_t nss_json_dispatch_flags = SD_JSON_ALLOW_EXTENSIONS;
 
 static void log_setup_nss_internal(void) {
+        int r;
+
         log_set_assert_return_is_critical_from_env();
         log_parse_environment_variables();
+
+        const char *e = getenv("SYSTEMD_NSS_LOG_LEVEL");
+        if (e) {
+                /* NSS plugins are linked statically to all of our own libraries so this will only override
+                 * the log level for the NSS plugin, and not for the entire systemd binary, since each will
+                 * have their own log_level TLS variable. */
+                r = log_set_max_level_from_string(e);
+                if (r < 0)
+                        log_warning_errno(r, "Failed to parse NSS log level '%s', ignoring: %m", e);
+        }
+
         if (DEBUG_LOGGING)
                 nss_json_dispatch_flags = SD_JSON_LOG;
 }