Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am currently making an upstart job run as an unprivileged user like so:

start on started mongodb
stop on runlevel [06]

respawn
respawn limit 10 100

env NODE_ENV=production

pre-start script
    ulimit -n 2048
end script

exec sudo -u mainuser /usr/bin/make -C /home/mainuser/app start-prod >> /home/mainuser/data/logs/app.log 2>> /home/mainuser/data/logs/app.err.log

This works good, with one exception: the log files app.log and app.err.log are being written as root (root becomes the owner of these files).

How do I ensure that the log files are written by the unprivileged mainuser?

share|improve this question

1 Answer 1

Some thoughts from the top of my head: you could use | sudo -u mainuser tee to write the file (but if you want to split STDOUT and STDERR it can become a bit messy), or you could in the script check if the log files exist and are owned by mainuser, if not create and chown mainuser. Then appending output as you do would keep ownership.

Quick snippet:

#!/bin/sh
user="mainuser"
group="mainuser"
for i in /home/mainuser/data/logs/app.log /home/mainuser/data/logs/app.err.log; do
    if [ ! -f "${i}" ] || [ "$(stat -c%U -- "${i}")" != "${user}" ]; then
        touch -- "${i}"
        chown ${user}:${group} -- "${i}"
    fi
done

This is quick and doesn't handle cases such as the log files existing as directories/links and so on very nicely, but in practice it might be fine.

I haven't worked with Upstart though, so maybe there are simpler ways.

share|improve this answer
    
I don't think an unprivileged user can "steal" or chown a file owned by root. The tee hint is more interesting, but before I try to implement it I will wait and see if there are any better options available, if you don't mind. Maybe I should just modify my make script so that it will do the logging. –  Tom May 20 '12 at 15:43
    
@Tom: You run the above test as root in the upstart script, in the pre-start script section I would guess, before dropping privilege to mainuser. Only root can chown as well. –  Daniel Andersson May 20 '12 at 15:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.