nohup - permission denied

I am trying to get a start up script for OrientDB (a database) on Ubuntu to work.

This is currently the line that causes problems:

ORIENTDB_DIR="/usr/local/orientdb"
ORIENTDB_USER="www-user"
sudo -u $ORIENTDB_USER sh -c "cd \"$ORIENTDB_DIR/bin\"; /usr/bin/nohup server.sh 1>../log/orientdb.log 2>../log/orientdb.err &"

If I start the script, it results in this:

sh: 1: cannot create ../log/orientdb.log: Permission denied

Here's the setup:

www-user is in the sudoers file
server.sh and any the shell script posted above have execute privileges for root.
If I change the script to this: sudo -u $ORIENTDB_USER sh -c "cd \"$ORIENTDB_DIR/bin\"; /usr/bin/nohup pwd 1>/home/www-user/test.log &", test.log shows /usr/local/orientdb/bin/ as the working directory.
/usr/local/orientdb/log exists but is an empty folder.

Given the above and the fact that I am using sudo to elevate the user, why is permission still denied?

Solution

You may have been misunderstanding sudo a bit — sudo does not necessarily elevate a user's rights; in fact, it may reduce the rights they have. When you pass sudo the -u flag, it will change to that user. If that user has more rights — root, for example (the default if -u is not passed) — then you'll get more rights. If the user has less rights — nobody, for example — you'll have less rights. You said that the log directory has these permissions:

drwxrwxr-x 2 root root 4096 Dec 11 10:13 /usr/local/orientdb/log

Yet, you're changing to the www-user user. The www-user user, unless it is part of the root group (unlikely), will not be able to write to that directory: it is only writable by the owner and group, and www-user is clearly not the root user and www-user is probably not part of the root group.

In short, don't pass -u (and its associated argument) if you want to elevate to root.