sudo: use tee rather than redirect