1

I'm working on a Python + Django application and it writes logs.

As I run app locally, logged-in as my user, I would like to enable my user to write logs to /var/logs.

I tried to add my user to syslog group: sudo usermod -a -G syslog mauro, but it does not works.

I wouldn't like to change path permissions (aka chmod +777 /var/logs), so, I can use the same set of settings for all environments.

Is there another way to do that, than change path permissions?

  • You don't need to give the user write access to /var/log. The application itself will write there on its own as long as it's set to do so in the config. – Nasir Riley Nov 5 '18 at 12:42
  • @NasirRiley but as Iḿ running the app as my user, this is the user that will try write/create files in var/log/*.log. – Mauro Baraldi Nov 5 '18 at 12:47
  • Then change the config to write the log to another directory that is owned by that user. – Nasir Riley Nov 5 '18 at 12:54
  • That is exactly what I do not want!! – Mauro Baraldi Nov 5 '18 at 12:59
  • @MauroBaraldi Why not? That would be a better and safer solution than giving the user full write access to /var/log. – Kusalananda Nov 5 '18 at 13:02
-1

Assuming Unix/Linux environment and it is supporting acl implementation, you can apply an acl like this:

sudo setfacl -m u:mauro:rw /var/logs

This utility (setfacl) sets Access Control Lists (ACLs) of files and directories, i.e. sets what permission a user(s)/group(s) can have on a particular file or directory.

Refer to man-page of setfacl(1)

Also, setfacl has a recursive option (-R) just like chmod:

You can use capital-x X permission, which means:

execute only if the file is a directory or already has
execute permission for some user (X)

So the new command will be like:

setfacl -R -m u:mauro:rwX /var/logs
  • the answer before edition does not worked. But, with recursive option works!! – Mauro Baraldi Nov 5 '18 at 12:58
  • 1
    that's great..it serves the purpose. – erTugRul Nov 5 '18 at 12:59
  • @erTugRul Could you write something about what this does and what the given user is allowed to do after executing this command? Are they, for example, able to create and delete files in the directory? Could they accidentally overwrite other log files? – Kusalananda Nov 5 '18 at 13:03
  • 2
    This would effectively give the user write access to the entire /var/log directory. – Nasir Riley Nov 5 '18 at 13:10
  • 2
    @erTugRul /var/logs is apparently a typo in the question. It's clear that he's talking about /var/log or else he wouldn't have been so worried about changing the permissions to it. – Nasir Riley Nov 5 '18 at 13:59
1

syslogd is your friend here. see https://stackoverflow.com/a/36762675/537980

syslogd has permission to write to this directory. It is designed for logging. It will not give any other permissions (just logging). See the linked above for more info (I am not an expert. I only know that it exists, and is what you need).

  • this is another very nice approach, but it implies in to change log handler. If it is doable, this answer could be satisfactory. And, as the answer you pointed says "If syslogd is running on your box, you can try to use SysLogHandler". – Mauro Baraldi Nov 5 '18 at 14:07
-1

Create the log file as root,

sudo touch /var/log/mylogfile.log

Make it owned by the correct user:

sudo chown user:group /var/log/mylogfile.log

If you do logfile rotations, make sure that the rotation service (logrotate or whatever you are using) creates or leaves an empty file with the right ownership whenever the logfile is rotated.

To allow a single user to write multiple logfiles, create a directory /var/log/mylogs that is owned by the user in question, then create the logfiles in that directory.

  • @Kuslananda this works fine for one file. Is there some solution for user level? As I work with other apps, I would like to enable my user, as a "log writer". – Mauro Baraldi Nov 5 '18 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.