Where to put utility scripts in Debian but not in the PATH?

Question

I have a web application with a database back-end. I have some utility scripts that are used to initialize the database. I want to include these scripts in the Debian package, but they are dangerous as they drop the schema and recreate.

So, I do not want to put these scripts in a directory in the PATH. Where do scripts of this nature go on a Debian system? (Note that these scripts are not package maintainer scripts.)

Answer 1

Debian's got a pretty comprehensive policy so it's usually worth referring to that. I think this covers it,

9.1.1 File System Structure

The location of all files and directories must comply with the Filesystem Hierarchy Standard (FHS), version 2.3, with the exceptions noted below, and except where doing so would violate other terms of Debian Policy.

And checking over the FHS we find,

/usr/lib : Libraries for programming and packages

Purpose

/usr/lib includes object files, libraries, and internal binaries that are not intended to be executed directly by users or shell scripts. [22]

Applications may use a single subdirectory under /usr/lib. If an application uses a subdirectory, all architecture-dependent data exclusively used by the application must be placed within that subdirectory.

then back to the Debian policy,

The requirement for object files, internal binaries, and libraries, including libc.so.*, to be located directly under /lib{,32} and /usr/lib{,32} is amended, permitting files to instead be installed to /lib/triplet and /usr/lib/triplet, where triplet is the value returned by dpkg-architecture -qDEB_HOST_MULTIARCH for the architecture of the package. Packages may not install files to any triplet path other than the one matching the architecture of that package; for instance, an Architecture: amd64 package containing 32-bit x86 libraries may not install these libraries to /usr/lib/i386-linux-gnu. [69]

Applications may also use a single subdirectory under /usr/lib/triplet.

The execution time linker/loader, ld*, must still be made available in the existing location under /lib or /lib64 since this is part of the ELF ABI for the architecture.

Answer 2

A common place for executables internal to a program is /usr/lib/program/.

(Older Debian systems use /usr/libexec/, but this isn't FHS-compliant.)

You could also modify the scripts to, for example, warn the user and exit if --force is not given in command line.

Answer 3

Where's your install root? If in /usr/local, I'd personally put them in /usr/local/sbin or /usr/local/etc/scripts directory. Normal users shouldn't have sbin in their PATH, and definitely not anything in etc. If it's in /opt, then you're even safer, since people will need to explicitly add /opt/WHATEVER/bin to their PATH, and you can put them anywhere but bin.

Do your scripts even need to have execute bit set? If you force people to run bash my_schema_loader.sh instead of running my_schema_loader.sh it will prevent most unintentional uses, but not interfere much with intentional use.