1 files changed, 30 insertions, 7 deletions
diff --git a/python/vyos/debug.py b/python/vyos/debug.py
index 20090fb85..6ce42b173 100644
--- a/python/vyos/debug.py
+++ b/python/vyos/debug.py
@@ -15,7 +15,7 @@
 
 import os
 import sys
-
+from datetime import datetime
 
 def message(message, flag='', destination=sys.stdout):
     """
@@ -41,11 +41,12 @@ def message(message, flag='', destination=sys.stdout):
     try:
         # at boot the file is created as root:vyattacfg
         # at runtime the file is created as user:vyattacfg
-        # the default permission are 644
-        mask = os.umask(0o113)
+        # but the helper scripts are not run as this so it
+        # need the default permission to be 666 (an not 660)
+        mask = os.umask(0o111)
 
         with open(logfile, 'a') as f:
-            f.write(_format('log', message))
+            f.write(_timed(_format('log', message)))
     finally:
         os.umask(mask)
 
@@ -80,10 +81,22 @@ def enabled(flag):
     return _fromenv(flag) or _fromfile(flag)
 
 
+def _timed(message):
+    now = datetime.now().strftime('%Y-%m-%d %H:%M:%S')
+    return f'{now} {message}'
+
+
+def _remove_invisible(string):
+    for char in ('\0', '\a', '\b', '\f', '\v'):
+        string = string.replace(char, '')
+    return string
+
+
 def _format(flag, message):
     """
     format a log message
     """
+    message = _remove_invisible(message)
     return f'DEBUG/{flag.upper():<7} {message}\n'
 
 
@@ -133,7 +146,7 @@ def _contentenv(flag):
     return os.environ.get(f'VYOS_{flag.upper()}_DEBUG', '').strip()
 
 
-def _contentfile(flag):
+def _contentfile(flag, default=''):
     """
     Check if debug exist for a given debug flag name
 
@@ -153,7 +166,8 @@ def _contentfile(flag):
         if not os.path.isfile(flagfile):
             continue
         with open(flagfile) as f:
-            return f.readline().strip()
+            content = f.readline().strip()
+        return content or default
 
     return ''
 
@@ -166,7 +180,7 @@ def _logfile(flag, default):
     """
 
     # For log we return the location of the log file
-    log_location = _contentenv(flag) or _contentfile(flag)
+    log_location = _contentenv(flag) or _contentfile(flag, default)
 
     # it was not set
     if not log_location:
@@ -177,6 +191,15 @@ def _logfile(flag, default):
        not log_location.startswith('/config/') and \
        not log_location.startswith('/var/log/'):
         return default
+    # Do not allow to escape the folders
     if '..' in log_location:
         return default
+
+    if not os.path.exists(log_location):
+        return log_location
+
+    # this permission is unique the the config and var folder
+    stat = os.stat(log_location).st_mode
+    if stat != 0o100666:
+        return default
     return log_location