I guess maybe restrict privs initially .. elevate privs in script, then write to file, then de-elevate in script?

possible?