I’m looking for a way to save the user’s execution log in JupyterHub.
I was able to implement a way to save the logs in a per-user directory using the IPython startup script, but users are still able to edit the logs.
Is there any way to save the logs in a way that users cannot edit them?
When I try to output to /var/log using the IPython startup script, I get permission denied.
Or is there another way?
IPython startup script sample
ip = get_ipython()
ip.run_line_magic('logstart', '-t -o ~/.jupyterhub/jupyterhub.log append')
I think you’ll need to run an additional service somewhere as a different user to receive the messages rather than writing to a simple file. That service can then write to a log file that the users cannot modify.
How exactly you build this service and authenticate it depends on your deployment scenario and security requirements (e.g. how important is it that users cannot disable the logging? How important is it that users cannot produce bogus log entries? etc.)
Almost anything implemented at the kernel level will be easy for users to modify.
Thank you.
I understood that simple implementation seems to be difficult.
Since it is an essential requirement that users cannot tamper with the logs, I would like to consider one of the following methods.
We will consider a mechanism to immediately copy the log with user privileges output by the IPython startup script with root privileges. (This has the problem of copying the logs, including tampering, and lagging.
I will read the JupyterHub and IPython programs and see if I can incorporate log output with root privileges.
If you have any other ideas, I would appreciate it if you could let me know.