Purpose

This example is a controlled shell lab. It contains a Bash script, test data, configuration, a smoke test and a run.sh that performs syntax checks, optional tool checks and evidence generation.

Local Check

./run.sh

Learning Goals

• trace script structure
• validate inputs
• observe error paths
• inspect evidence files
• derive review rules

Files

• bin/sudo_path_hardening.sh
• tests/smoke.sh
• data/input.txt
• scenario.json

Review Checklist for Sudo Path Hardening

• 01. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
• 02. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
• 03. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
• 04. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
• 05. separate stderr and stdout: Record the affected file, command, exit code and risk.
• 06. create temporary files with mktemp: Record the affected file, command, exit code and risk.
• 07. test cleanup through trap: Record the affected file, command, exit code and risk.
• 08. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
• 09. never print or commit secrets: Record the affected file, command, exit code and risk.
• 10. check PATH and external dependencies: Record the affected file, command, exit code and risk.
• 11. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
• 12. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
• 13. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
• 14. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
• 15. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
• 16. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
• 17. separate stderr and stdout: Record the affected file, command, exit code and risk.
• 18. create temporary files with mktemp: Record the affected file, command, exit code and risk.
• 19. test cleanup through trap: Record the affected file, command, exit code and risk.
• 20. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
• 21. never print or commit secrets: Record the affected file, command, exit code and risk.
• 22. check PATH and external dependencies: Record the affected file, command, exit code and risk.
• 23. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
• 24. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
• 25. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
• 26. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
• 27. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
• 28. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
• 29. separate stderr and stdout: Record the affected file, command, exit code and risk.
• 30. create temporary files with mktemp: Record the affected file, command, exit code and risk.
• 31. test cleanup through trap: Record the affected file, command, exit code and risk.
• 32. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.
• 33. never print or commit secrets: Record the affected file, command, exit code and risk.
• 34. check PATH and external dependencies: Record the affected file, command, exit code and risk.
• 35. handle ShellCheck warnings or suppress them with a reason: Record the affected file, command, exit code and risk.
• 36. document portability assumptions between Bash and POSIX sh: Record the affected file, command, exit code and risk.
• 37. name the shebang and target shell explicitly: Record the affected file, command, exit code and risk.
• 38. quote variable expansions unless word splitting is deliberate: Record the affected file, command, exit code and risk.
• 39. validate inputs before they influence filenames, options or commands: Record the affected file, command, exit code and risk.
• 40. evaluate and document exit codes explicitly: Record the affected file, command, exit code and risk.
• 41. separate stderr and stdout: Record the affected file, command, exit code and risk.
• 42. create temporary files with mktemp: Record the affected file, command, exit code and risk.
• 43. test cleanup through trap: Record the affected file, command, exit code and risk.
• 44. guard destructive operations with dry-run, scope checks and confirmation: Record the affected file, command, exit code and risk.

Practice Appendix: Sudo Path Hardening

This appendix is a working backlog for longer trainings, reviews and repetitions. Each task can be checked locally with Bash, test data and a Git repository.

A001. sudo, PATH, absolute Kommandos und Least Privilege

• Task: validate input and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A002. Bash

• Task: explain exit code and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A003. Testing

• Task: check quoting and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A004. Security

• Task: test error path and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A005. sudo, PATH, absolute Kommandos und Least Privilege

• Task: review log output and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A006. Bash

• Task: trace cleanup and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A007. Testing

• Task: scope portability and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A008. Security

• Task: mark security risk and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A009. sudo, PATH, absolute Kommandos und Least Privilege

• Task: document recovery path and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A010. Bash

• Task: write review rule and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A011. Testing

• Task: validate input and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A012. Security

• Task: explain exit code and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A013. sudo, PATH, absolute Kommandos und Least Privilege

• Task: check quoting and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A014. Bash

• Task: test error path and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A015. Testing

• Task: review log output and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A016. Security

• Task: trace cleanup and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A017. sudo, PATH, absolute Kommandos und Least Privilege

• Task: scope portability and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A018. Bash

• Task: mark security risk and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A019. Testing

• Task: document recovery path and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A020. Security

• Task: write review rule and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A021. sudo, PATH, absolute Kommandos und Least Privilege

• Task: validate input and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A022. Bash

• Task: explain exit code and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A023. Testing

• Task: check quoting and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A024. Security

• Task: test error path and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A025. sudo, PATH, absolute Kommandos und Least Privilege

• Task: review log output and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A026. Bash

• Task: trace cleanup and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A027. Testing

• Task: scope portability and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A028. Security

• Task: mark security risk and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A029. sudo, PATH, absolute Kommandos und Least Privilege

• Task: document recovery path and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A030. Bash

• Task: write review rule and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A031. Testing

• Task: validate input and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A032. Security

• Task: explain exit code and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A033. sudo, PATH, absolute Kommandos und Least Privilege

• Task: check quoting and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A034. Bash

• Task: test error path and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A035. Testing

• Task: review log output and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A036. Security

• Task: trace cleanup and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A037. sudo, PATH, absolute Kommandos und Least Privilege

• Task: scope portability and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A038. Bash

• Task: mark security risk and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A039. Testing

• Task: document recovery path and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A040. Security

• Task: write review rule and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A041. sudo, PATH, absolute Kommandos und Least Privilege

• Task: validate input and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A042. Bash

• Task: explain exit code and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A043. Testing

• Task: check quoting and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A044. Security

• Task: test error path and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A045. sudo, PATH, absolute Kommandos und Least Privilege

• Task: review log output and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A046. Bash

• Task: trace cleanup and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A047. Testing

• Task: scope portability and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A048. Security

• Task: mark security risk and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A049. sudo, PATH, absolute Kommandos und Least Privilege

• Task: document recovery path and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A050. Bash

• Task: write review rule and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A051. Testing

• Task: validate input and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A052. Security

• Task: explain exit code and connect the observation explicitly to Security.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A053. sudo, PATH, absolute Kommandos und Least Privilege

• Task: check quoting and connect the observation explicitly to sudo, PATH, absolute Kommandos und Least Privilege.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A054. Bash

• Task: test error path and connect the observation explicitly to Bash.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.

A055. Testing

• Task: review log output and connect the observation explicitly to Testing.
• Evidence: Record the checked command, expected output, actual output and exit code.
• Operations question: What happens with empty input, missing files, missing tools and repeated execution?
• Security question: Can input become an option, path, glob, subshell, eval expression or secret leak?
• Recovery: Describe revert, cleanup, restore, secret rotation or manual correction.