I'm trying to move away from running cron-scheduled jobs with root, so the thought process is to create a system account with no login (/dev/null home, /sbin/nologin shell) to run each cron job we need ran. I'm just curious how to give these accounts the proper permission to run where they need to be without changing the ownership of normal files and folders that are typically restricted to root.
For instance, say I want this system account to output log files of what it's doing to /var/log, However, /var/log/ is owned by root, and is set to 755. This process won't be able to create log files there without running as root, correct?
Am I correct in assuming using Linux Kernel Capabilities is the best way to do this?