Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am writing a script that I want to run without privileges. I want the errors that the script encounters to be logged to some log file. I do not not have privileges to write one to /var/log. And I do not want to have one in my home directory.

Is there a location where userspace scripts may log runtime information? What is the best practice to have my script log information to /var/log without creating any potential security issues? I am hesitant to set uid / gid on the script.

share|improve this question

3 Answers 3

up vote 3 down vote accepted

You can't write to /var/log as a normal user, but the syslog daemon will do it for you if you ask. If you'd like to log messages to the standard system logs (e.g. /var/log/syslog), the 4.4BSD utility logger might be available on your system. It's installed by default on Debian, and is in the bsdutils package on Debian derivatives.

You'll get the advantage of any pre-existing log rotation, maintenance, and monitoring tools, with the disadvantage of needing privileges to read the system logs, and of having your script's messages mixed in with messages from other programs.

$ logger Hello
$ echo Goodbye | logger
$ sudo tail -2 /var/log/syslog
Feb 19 21:16:15 debian-host jander: Hello
Feb 19 21:16:21 debian-host logger: Goodbye

There are several configuration options available; you can read more in man logger.

share|improve this answer

Generally for a daemon the log file is created by root then the permissions are altered so that the non-privileged user can write to it. logrotate is then set up to preserve permissions during rotation.

If it's a command, not a daemon, then log to /tmp (preferably using mktemp) and inform the user via STDOUT where the log went.

share|improve this answer
    
Good idea. I have a few lines in my ~/.profile that checks to see if dropbox demon is running and starts it if it is not. I was considering adding an & to avoid holding up the prompt, but starting dropbox writes to the console. I am currently redirecting it's output to /dev/null, but would like to have some way to debug if dropbox fails to start. –  Lord Loh. Feb 19 '13 at 23:08
1  
Check out daemonize. –  bahamat Feb 19 '13 at 23:10
    
Just to know, "permissions are altered so that the non-privileged user can write to it." is this done by simply chmod 666? or do I have to add user to a group or something like that? –  Lord Loh. Feb 19 '13 at 23:11
    
Better under /var/tmp, /tmp is not guaranteed to survive a boot. –  vonbrand Feb 20 '13 at 1:22
    
@LordLoh.: Yes, with chmod. Usually 0644 or 0664 and the user/group ownership is also changed to that of the daemon that is expected to be writing to it. –  bahamat Feb 20 '13 at 22:02

If you as an ordinary user decide to run a program, the natural place for its logs are in your home directory. Your home directory is meant for you to store all your files, whether they are logs of a program you run or anything else.

If the program is executed as part of the system, running as a typically dedicated system user, then the natural place for its logs is in /var/log. Create a subdirectory /var/log/myapp and give it appropriate permissions so that your application can write there.

If relevant and your operating system allows it, mark the log file as append-only. Only root can do this. This has the advantage that if your application is compromised, it won't be able to erase past logs, which can be very useful for forensic analysis of the compromise. You will need root's intervention to rotate the log: chown so that the log file is can no longer be opened by the application, rename the log file, create a new append-only file with appropriate ownership, then notify the application to open the new empty file.

You can make any application log to the system logs by calling logger(1) or syslog(3).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.