I'd like to add my vote to the sudo camp. In fact for the best security, I'd say don't run the script from sudo, but call sudo from the script at the point(s) you need elevated priviliges. That way you localise the bits that you need to be extra wary of.