[bug]: help command broken as non-root with trace enabled

[TobiPeterG]

Pre‑submission checklist

• I searched existing issues and discussions to avoid duplicates
• I tested with the latest released packages or the current git (if applicable)
• I can reproduce this on a clean boot or after reboot

Short summary

sdbootutil --help breaks when trace log is enabled and not run as root

Observed behavior

When I enable the trace route, e.g. through the flag, subsequent calls to sdbootutil --help (or just sdbootutil) break when run without root priviliges. I see:
$ sdbootutil 
The trace of the code is being stored in /var/log/sdbootutil.log
Remove the file or use --stop-trace-code to stop tracing the code
Audit the file before sharing, as secrets can be leaked
/usr/bin/sdbootutil: line 19: /var/log/sdbootutil.log: Permission denied

$ sdbootutil --help
The trace of the code is being stored in /var/log/sdbootutil.log
Remove the file or use --stop-trace-code to stop tracing the code
Audit the file before sharing, as secrets can be leaked
/usr/bin/sdbootutil: line 19: /var/log/sdbootutil.log: Permission denied

Expected behavior

I think the help command should still work, even without root permissions when the trace log is active.

Steps to reproduce

1. Run any sdbootutil command with the --start-trace-code flat to enable the trace log
2. Try to run sdbootutil or sdbootutil --help without root permissions
3. See error (and no help :( )

Product / distro

Other

Architecture

x86_64

Platform

Bare metal

Bootloader

systemd-boot

sdbootutil version

Version : 1+git20260108.be38224-1.1

System specs (paste output)

## os-release
NAME="Yuga"
ID="yuga"
ID_LIKE="suse opensuse opensuse-tumbleweed opensuse-microos opensuse-aeon aeon"
VERSION="20260112"
VERSION_ID="20260112"
PRETTY_NAME="Yuga Linux (KDE Edition)"
VARIANT="KDE"
VARIANT_ID="kde"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:yuga:kde:20260112"
BUG_REPORT_URL="https://github.com/YugaLinux/Project/issues"
HOME_URL="https://github.com/YugaLinux/Project"
DOCUMENTATION_URL="https://github.com/YugaLinux/Project"
LOGO="distributor-logo-steamdeck"

## uname
Linux linux.fritz.box 6.17.7-1-handheld #1 SMP PREEMPT_DYNAMIC Fri Nov  7 02:48:45 UTC 2025 (f13b87b) x86_64 x86_64 x86_64 GNU/Linux

## bootctl status
System:
      Firmware: UEFI 2.70 (INSYDE Corp. 3877.00)
 Firmware Arch: x64
   Secure Boot: disabled
  TPM2 Support: yes
  Measured UKI: no
  Boot into FW: supported

Current Boot Loader:
      Product: systemd-boot 257.9+suse.23.gc139debf2c
     Features: ✓ Boot counting
               ✓ Menu timeout control
               ✓ One-shot menu timeout control
               ✓ Default entry control
               ✓ One-shot entry control
               ✓ Support for XBOOTLDR partition
               ✓ Support for passing random seed to OS
               ✓ Load drop-in drivers
               ✓ Support Type #1 sort-key field
               ✓ Support @saved pseudo-entry
               ✓ Support Type #1 devicetree field
               ✓ Enroll SecureBoot keys
               ✓ Retain SHIM protocols
               ✓ Menu can be disabled
               ✓ Multi-Profile UKIs are supported
               ✓ Boot loader set partition information
    Partition: /dev/disk/by-partuuid/da9ccb54-adb7-4559-b370-675756b7a947
       Loader: └─/EFI/systemd/grub.efi
Current Entry: yuga-6.17.7-1-handheld-4.conf
Default Entry: yuga-6.17.7-1-handheld-5.conf

Random Seed:
 System Token: set
       Exists: no

Available Boot Loaders on ESP:
          ESP: /boot/efi (/dev/disk/by-partuuid/da9ccb54-adb7-4559-b370-675756b7a947)
Failed to read "/boot/efi/EFI/systemd": Permission denied
         File: (can't access /boot/efi: Permission denied)

Boot Loaders Listed in EFI Variables:
        Title: Yuga Linux (KDE Edition) Boot Manager
           ID: 0x0003
       Status: active, boot-order
    Partition: /dev/disk/by-partuuid/da9ccb54-adb7-4559-b370-675756b7a947
         File: └─/EFI/systemd/shim.efi

        Title: HoloISO snapshot20240603.0905.04 (GRUB)
           ID: 0x0005
       Status: active
    Partition: /dev/disk/by-partuuid/ea153df5-7533-4b8d-afd4-79ad8c0095d7
         File: └─/EFI/steamos/grubx64.efi

Failed to open '/boot/efi//loader/loader.conf': Permission denied

## lsblk
NAME            SIZE TYPE  FSTYPE      MOUNTPOINTS
zram0           7.2G disk  swap        [SWAP]
nvme0n1       476.9G disk              
├─nvme0n1p1       4G part  vfat        /.snapshots/3/snapshot/boot/efi
│                                      /.snapshots/3/snapshot/boot/efi
│                                      /boot/efi
└─nvme0n1p2   472.9G part  crypto_LUKS 
  └─yuga_root 472.9G crypt btrfs       /.snapshots/3/snapshot/usr/local
                                       /.snapshots/3/snapshot/usr/local
                                       /.snapshots/3/snapshot/swap
                                       /.snapshots/3/snapshot/swap
                                       /.snapshots/3/snapshot/opt
                                       /.snapshots/3/snapshot/opt
                                       /.snapshots/3/snapshot/srv
                                       /.snapshots/3/snapshot/srv
                                       /.snapshots/3/snapshot/home
                                       /.snapshots/3/snapshot/home
                                       /.snapshots/3/snapshot
                                       /tmp/transactional-update-jis5tO
                                       /usr/local
                                       /swap
                                       /home
                                       /opt
                                       /srv
                                       /.snapshots
                                       /var
                                       /root
                                       /etc
                                       /

## systemd-detect-virt
none

## sdbootutil version
sdbootutil-1+git20251218.1cd7294-1.1.x86_64

Debug trace excerpts (sanitized)

Couldn't generate one, didn't have the permission ;)

Additional context

Can this issue be reproduced?