#!/usr/bin/env bash
set -u
set -o pipefail
export LC_ALL=C

# Own a new directory; verify physical paths before cleanup.
parent=$(cd -- "${TMPDIR:-/tmp}" && pwd -P) || exit 1
work=$(mktemp -d "$parent/bhylu-bash.XXXXXX") || exit 1
work=$(cd -- "$work" && pwd -P) || exit 1
case "$work" in "$parent"/bhylu-bash.??????) ;; *) exit 1 ;; esac
cleanup() {
    cd -- "$parent" || return 1
    [[ -d $work && ! -L $work ]] || return 1
    [[ $(cd -- "$work" && pwd -P) == "$work" ]] || return 1
    case "$work" in "$parent"/bhylu-bash.??????) rm -r -- "$work" ;; *) return 1 ;; esac
}
trap cleanup EXIT
cd -- "$work" || exit 1

file="private-note.txt"
printf "synthetic note\n" > "$file"
chmod u=rw,go= -- "$file"
ls -l -- "$file"
printf "Review owner/group with id and ls before any chown or chgrp change.\n"