One approach as an ordinary user is an
exec wrapper, assuming the programs are run via a
PATH search. That is, your wrapper for
env > /some/log/file
... (any other desired logging commands here) ...
exec /path/to/real/program "$@"
must exist first in
PATH, so you might have
PATH=/some/wrapper/dir:$PATH and then a wrapper
program named exactly for the real
program to be logged, and in the wrapper
program you replace your wrapper with the original
exec. If the program is being run by fully qualified paths then it may be necessary to fiddle around with something like
LD_PRELOAD or perhaps the application in question may give an option to change the path?
root tracing would be quite simple with something like
sysdig (various sysdig examples) as that can match the ephemeral process names you are interested in, and can incrementally drill down to what you are interested in, say the program
ls run as some user:
sudo sysdig "proc.name = ls and user.name = jhqdoe" | tee log
The rather verbose
log file after an
ls is run shows an
execve entry that may give almost everything you need (the environment is truncated):
9734 16:12:49.683389228 1 ls (20542) < execve res=0 exe=ls args=--color=auto. tid=20542(ls) pid=20542(ls) ptid=20052(bash) cwd= fdlimit=1024 pgft_maj=0 pgft_min=61 vm_size=404 vm_rss=4 vm_swap=0 comm=ls cgroups=cpuset=/.cpu_cgroup=/.cpuacct=/.mem_cgroup=/.devices=/user.slice.freezer=/.ne... env=XDG_SESSION_ID...
Via the user guide and other documentation, the above can be made precise to only the
execve call and the full environment shown via:
sudo sysdig -p "%proc.env" "proc.name = ls and user.name = jhqdoe and evt.type = execve" | tee xxx
-p to show what you want; you could also use a chisel to extract what you want from a live capture or a save file, etc.