Where should I put ownerless log file

Question

I have a script that moves in and out of using sudo. Certain commands have to be executed as $USER and certain commands have to be executed as root.

Currently, I'm running a loop in the background to keep sudo active so you execute the script, enter your password once, the script sudos the commands the it needs (runs the rest as regular user), and then the background loop terminates when the script does. This script is only run in a very controlled environment and I am not worried about the sudo access being left open during the process.

However, I'm also trying to log this script in a place that won't get cleaned up afterwards. Here are the pertinent parts of the script:

#!/bin/bash

logFile="path/to/log/file"

main () {
   # some getopts
}

getOptExample () {
   sudoFunction
   # do some other stuff that takes a really long time
   # and bounces back and forth between sudo and not sudo
   cleanUp
}

getOptOtherExample () {
   sudoFunction
   # do some other stuff that takes a really long time
   # and bounces back and forth between sudo and not sudo
   cleanUp
}

sudoFunction () {
    sudo -v
    while true;
    do
        sudo -n true
        sleep 60
        kill -0 "$$" || exit
    done 2>/dev/null &
}

cleanUp () {
    # remove script file
    # remove tmp dir that we're working in
    # reboot computer to apply all changes
}

(main "$@") 2>&1 | tee $logFile

I can't write to /var/log because the last line of the script happens before the sudo function is invoked, so it only has the permissions for the executing user. I also can't write to my tmp dir because it gets cluttered up and I need to remove the files in there after the script is complete. Also, the directory has no reason to stick around after the work that the script automates is complete.

• I do have an account that has an unaffected home directory, but the user doesn't have permissions to create a file in that home directory.
• This script is being run on mac OS, however, I'm trying to keep it as compatible with other/future/non-mac stuff (sticking to bash, trying to stick to posix, hell, even trying to stick with Linus' guidelines for adding to the Linux kernel).
• I need the logfile to persist through at least one reboot

Where should I dump the logfile for this script that is:

• Easy to find (intuitive)
• User writable without sudo
• Does not write to the user's home directory
• Doesn't get deleted at reboot

Or is there a better way for me to do this (I can post the whole, huge script if necessary)?

Answer 1

Use basic file permissions or ACL to get that done.

There is e.g the group section in permissions, and a command called newgrp to switch the primary group. Also consider the SGID bit an using e.g. nobody as owner.

Not sure, if ACL is available on OSX, but I expect that it is there. Just use setfacl to allow the user|group to access and write to the logfile.

Typically /var/log/ should be used for logfiles. E.g. setup a folder in /var/log/yourscripname with proper permissions.