Recent posts tagged bash

A world-writable file can be rewritten by every account on the machine — including the service account your web server runs as. Code executing as www-data through a compromised plugin doesn't need root: any chmod 777 you left behind during past debug...

A 64M scratch tmpfs, a worker process holding its log open on file descriptor 3, and the usual reflex when space runs low: rm the log. du on the directory dropped from 48M to 0. df stayed at 48M used. The next 32M write failed with No space left on d...

Context and Problem An AWS EKS Cluster was attacked, and its secrets were compromised. The Kubernetes Secrets were not encrypted, anyone who works with Kubernetes know they are only base64-encoded by defaulthttps://kubernetes.io/docs/concepts/confi...

Most "the filter looks right but the script misbehaves" bugs come down to three silent failure modes. First, a missing -r. jq outputs JSON by default, so a string arrives with its quotes attached — your variable holds "web-01", quotes included, and ...

Mantenho todos os meus repositórios em uma única pasta — cerca de 150, entre trabalho para clientes, templates e experimentos. Cada um deles é uma pequena armadilha: um nodemodules dentro de app/ e um .terraform dentro de infra/terraform/. Nenhum dos...

If grep returns empty on a file you know contains matches, suspect the pattern before the file. Default grep uses Basic Regular Expressions BRE, where |, +, ?, and are literal characters unless backslash-escaped. So grep "error|failed" app.log searc...

A demo script called report, two directories on PATH, and one mv between them, all on a scratch tmpfs: $ report report 2.1: 14 jobs ok exit=0 $ mv /opt/jobs/bin/report /opt/jobs/newbin/report $ ls -l /opt/jobs/newbin/report rwxrwxr-x 1 root root 42 ...

The trap with rsync is that its dangerous flag combinations don't fail — they complete a different operation than the one you intended, and exit 0. --delete makes the destination match the source, so a mistyped or freshly moved source directory means...

If your project mixes languages, one terminal command can run each language's own tests and security checks and fail the build when anything is red. The script 1 counts files per language, 2 runs build and type checks, 3 runs tests and SAST, 4 scans...

The standard bash alerting pattern ends the same way everywhere you read it: pipe the finding into mail. So I checked what my own box would actually do with that line. $ type -a mail mailx sendmail mail not found mailx not found sendmail not found ...

I wrote four lines to capture a bash error for a guide. One empty variable, tested twice: $ cat queue-check.sh !/bin/bash count="" if $count -eq 0 ; then echo "queue empty"; fi if $count -eq 0 ; then echo "queue empty "; fi $ bash queue-check.sh...

Four config files, one hostname to rename. I knew the dot in api.internal is a regex wildcard, so I escaped it. grep -rn 'api.internal' unescaped matched a fourth file containing apiXinternal — a typo somebody deliberately kept. Escaped, api\.interna...

I set three log files to known ages with touch -d — exactly 30 days, 30 days and 12 hours, and 31 days — then ran what I thought was a 30-day retention policy: find . -name '.log' -mtime +30 It returned one file: the 31-day-old one. The 30.5-day f...