Page 12 - Bash

Deployment scripts in practice often run with far more privileges than needed, usually because a blanket sudo grant feels more convenient than a precise rule. Taking least privilege seriously means writing targeted sudoers entries per script and skipping the SUID bit on shell scripts, which modern Linux kernels ignore for good reason.

sed, awk and perl can all solve text processing tasks in the shell, but each one brings different strengths, limits and performance characteristics. sed handles line based substitution, awk handles structured field processing, and perl covers complex logic, multiline patterns and Unicode. Picking the right tool saves time and avoids fragile solutions.

Processing a 20 GB log file with a Bash loop that collects lines into an array is one of the most reliable ways to push a server into swapping. awk was built from the ground up as a streaming tool, processing each line individually and keeping memory usage nearly constant regardless of file size.

A new code path in a production Bash script is always a risk, no matter how carefully it was tested. A feature flag turns that all-or-nothing risk into a controllable decision: the new path exists in the script but is off by default, can be enabled for individual runs, and can be switched back off with a single value if something goes wrong.

Bash history is often the first data source an administrator checks after a security incident. Configured correctly with HISTFILE, HISTSIZE and HISTTIMEFORMAT, it provides a timeline of executed commands. But relying on it alone overlooks that any user with shell access can clear or manipulate their own history at any time, which is why auditd belongs in every serious hardening effort as an independent complement.

eval in Bash takes a concatenated string and evaluates it a second time as a shell command, and that is exactly the problem: any unvalidated input flowing into that string can inject arbitrary commands. This article walks through concrete attack scenarios involving eval and introduces safe alternatives such as arrays, namerefs, and printf minus v, which achieve the same dynamism without command injection.

A Bash script that calls curl, ssh or mysqldump cannot be meaningfully tested without touching real network connections or databases on every test run. Mocking external commands solves exactly this problem: the PATH override pattern and targeted function overriding make Bash tests deterministic, fast and independent of real infrastructure.

Shell scripts without tests are a black box in your automation. The Bash Automated Testing System (BATS) brings structured unit tests, fixtures, and mocking to the shell world, and it integrates seamlessly into GitHub Actions, GitLab CI, and Jenkins without any external runtime dependencies.

A named pipe (FIFO) behaves like a file on the filesystem but works like a classic pipe: data flows directly from a writer to a reader and never lands on disk. Used correctly, FIFOs decouple independent processes, build logging multiplexers, and avoid the race conditions that intermediate files almost always introduce.

A standalone Bash CLI tool distributed without a package manager needs its own way to stay current on users' machines. A self-update mechanism downloads new versions, verifies them, replaces the running script atomically, and rolls the change back on failure before users even notice anything went wrong.