When running as non-root user, cf-agent complains "Can't open lock-log file".
The error happens because it tries to work with files in /var/log, but doesn't
have enough permissions.

You may reproduce the issue from a non-root account as follows:

rm -rf ~/.cfagent
mkdir ~/.cfagent ~/.cfagent/bin ~/.cfagent/inputs
cp /usr/sbin/cf-* ~/.cfagent/bin/
cat - >~/.cfagent/inputs/promises.cf <<EOF
# -*- coding: utf-8; mode: cfengine -*-
body common control
{
  bundlesequence => { "test" };
}

bundle agent test
{
commands:
  "/bin/date" ;
}
EOF
env LANG=C cf-agent; echo $?

The commands will produce something like that:

Q: ".../bin/date": Tue May 10 15:40:36 YEKST 2011
I: Last 1 QUOTed lines were generated by promiser "/bin/date"
Can't open lock-log file /var/log/cf3.<hostname>.runlog
 !!! System error for fopen: "Permission denied"
1 <-- (take note exit code signals about some error)

The problem was found in package version 3.0.5+dfsg-1 from Ubuntu Natty,
but I beleive it affects Debian also. The cause is fhs-compilance patch.
As of git commit 4135c262699566a709eb940f8973b94b2a5f75a5, the patch
doesn't take into account that working directory for non-root users
is ~/.cfengine and FHS rules can't be applied in this case. In my opinion,
we should not change upstream behavior for regular users.

Here is a debdiff with modified debian/patches/fhs-compliance on top
of git commit 826a741f45aa0617336583bd5c2d01db2ad994b1.
The fix works for me. Please consider including it into next versions.

tag 626280 +confirmed pending
thanks

Hi,
thanks for the patch, I will include it in the next version, I believe
that geteuid() is the function to be used here, rather than getuid().

Cheers
Antonio

The CFEngine 3 Tutorial recommends you experiment using an ordinary user
without root privileges, in for example chapter 4. Apparently it doesn't
work on Debian without write access to the log directory, which is
unfortunate.

/Mikael