Things like setuid privileges occur at the process level. Since the script and the module it loads during its execution is one logical process, nothing your module can do by this time can elevate the process's privileges.
You have three options that I can think of:
- You can make all of your scripts that need access to this privileged log file setuid (a scary proposition)
- If your filesystem supports special file attributes, you may be able to set up the log file so that it can only be appended to. In Linux, under ext2, this can be accomplished by running "chattr +a filename". You can then set the file's permissions so that it's world-writable, but only root-readable. Now, any Joe User can add a line to this file (which means your scripts can), but he can't read what's in the file, delete it, or make changes to it.
- The recommended way is to set up an external process, a daemon, that listens for log requests from a client and writes those log requests to the file in question. This daemon would run as the privileged user and would be the only thing capable of reading/writing to this log file. You'd just then have to code some IPC logic in your script (through this module) to send the data to the daemon to be logged
Note that 'syslog' is everything option (3) above is. I would highly recommend it if you could adapt syslog to your needs (or your needs to what syslog provides) before you re-invent syslog.
Hope this helps..