Write the installer log to /var/log instead of a world-writable /tmp file

install.sh ran as root and created /tmp/aic8800d80_install.log with mode
666 at a fixed, predictable path. Root writing to a fixed name in /tmp is
open to symlink races (mitigated, not removed, by fs.protected_symlinks),
and a world-writable log lets any local user alter what an administrator
later reads.

The log now lives at /var/log/aic8800-install.log, is created with mode
0644 only after the root check, and failed writes before that point are
silenced instead of printing redirection errors. diagnostic_build.sh
reads the new path and falls back to the old one for logs left by
earlier installers.

diagnostic_build.sh

@@ -19,7 +19,11 @@ NC='\033[0m'
 
 DRV_NAME="aic8800"
 DRV_VERSION="1.0.0"
-INSTALL_LOG="/tmp/aic8800d80_install.log"
+INSTALL_LOG="/var/log/aic8800-install.log"
+# Installers before this change wrote their log to /tmp.
+if [ ! -f "$INSTALL_LOG" ] && [ -f /tmp/aic8800d80_install.log ]; then
+    INSTALL_LOG="/tmp/aic8800d80_install.log"
+fi
 
 read_dkms_conf_value() {
     local key="$1"

install.sh

@@ -24,7 +24,7 @@ readonly DRV_NAME="aic8800"
 readonly DRV_VERSION="1.0.0"
 readonly SRC_DIR="/usr/src/${DRV_NAME}-${DRV_VERSION}"
 readonly MODULE_NAME="aic8800_fdrv"
-readonly LOG_FILE="/tmp/aic8800d80_install.log"
+readonly LOG_FILE="/var/log/aic8800-install.log"
 
 # Script directory (where the script is located)
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -37,12 +37,7 @@ readonly SCRIPT_DIR
 log_message() {
     local level="$1"
     shift
-    # Garantir que o arquivo de log existe e tem permissões corretas
-    if [ ! -f "$LOG_FILE" ]; then
-        touch "$LOG_FILE" 2>/dev/null || true
-        chmod 666 "$LOG_FILE" 2>/dev/null || true
-    fi
-    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [$level] $*" >> "$LOG_FILE" 2>/dev/null || true
+    { echo "[$(date '+%Y-%m-%d %H:%M:%S')] [$level] $*" >> "$LOG_FILE"; } 2>/dev/null || true
 }
 
 print_info() {
@@ -828,10 +823,13 @@ show_final_instructions() {
 #############################################################################
 
 main() {
-    # Initialize log file
+    # Step 1: Check root privileges (before touching the log, which lives in
+    # /var/log and is written by root only)
+    check_root
+
+    # Initialize log file: owned by root, readable by all, never world-writable
     rm -f "$LOG_FILE" 2>/dev/null || true
-    touch "$LOG_FILE" 2>/dev/null || true
-    chmod 666 "$LOG_FILE" 2>/dev/null || true
+    install -m 0644 /dev/null "$LOG_FILE" 2>/dev/null || true
 
     echo -e "${CYAN}"
     echo "╔════════════════════════════════════════════════════════════════╗"
@@ -844,9 +842,6 @@ main() {
     log_message "INFO" "Kernel: $(uname -r)"
     log_message "INFO" "Distribution: $(grep PRETTY_NAME /etc/os-release 2>/dev/null | cut -d= -f2 | tr -d '"')"
     
-    # Step 1: Check root privileges
-    check_root
-    
     # Step 2: Check Secure Boot
     check_secure_boot