{"version":"2.1.269","anchor":"bash-tool-deny-rule-check-now-also-screens-read-only-referen","canonical_anchor":"bash-tool-deny-rule-check-now-also-screens-read-only-referen","heading":"Bash-tool deny-rule check now also screens read-only referenced paths","tier":"notice","area":"Bash Tool","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269\/e\/bash-tool-deny-rule-check-now-also-screens-read-only-referen","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.269","markdown":"### Bash-tool deny-rule check now also screens read-only referenced paths\n\nBash deny-rule checks now also screen read-only file paths, such as those read by awk's getline\n\n**What**\n\nThe permission check that screens file paths touched by a Bash command against deny rules (rules that block access to certain files) now checks two separate lists: the paths the command writes to or otherwise operates on, and a new, optional list of paths that are only read, such as files referenced by an `awk`\/`gawk` `getline` call. The read-only list is checked specifically under the 'read' permission verb.\n\n**Why**\n\nThis closes a gap where a command could read a forbidden file's contents through a side channel like `getline`, even if direct writes to that file were already blocked.\n\n- Area: Bash Tool\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}