You'll notice
Bash deny-rule checks now also screen read-only file paths, such as those read by awk's getline
What
The permission check that screens file paths touched by a Bash command against deny rules (rules that block access to certain files) now checks two separate lists: the paths the command writes to or otherwise operates on, and a new, optional list of paths that are only read, such as files referenced by an awk/gawk getline call. The read-only list is checked specifically under the 'read' permission verb.
Why
This closes a gap where a command could read a forbidden file's contents through a side channel like getline, even if direct writes to that file were already blocked.