What
Bash permission checks now treat a file named by an output flag as something being written, not read. sort -o out.txt, sort -T dir, and the -t target of cp and mv go through write permission first, and a deny stops the whole command.
Details
- The analyser carries a table of which flags take a value and which of those values are write targets:
sort: { valueLetters: "otkST", writeLetters: "oT" },uniq: { valueLetters: "fsw", writeLetters: "" }, plus the-tform for cp and mv. uniqhas no write letters, so its-f,-sand-wvalues are consumed as flag arguments rather than mistaken for paths.- Previously every path in these commands was analysed as a read.
Evidence
sort: { valueLetters: "otkST", writeLetters: "oT" }
Strings lifted out of the shipped bundle, so the claim above can be checked against them.