A fix is proven by the same operation, by the same user, that was refused. Other commands may succeed without any fix.
You check a script by running it by its path, ./report.sh. bash report.sh reads the file as text and works without x, so it says nothing about x. You check a colleague's file as the colleague, through sudo -u: sudo cat runs as root and gets through almost anywhere.
Then make sure you did not open too much. stat -c '%a %U:%G' file prints the mode, owner, and group: compare them with the requirement. "It works" is true after chmod 777 too, but the requirement "others get nothing" is broken.
You added x to deploy.sh so it can be run by its path. Which command checks that the fix worked?
-
bashreads the file as text and runs it even withoutx, as at the start of the lesson. It says nothing about running by path. -
That way root runs the script, but you are the one who needs to run it. The check must come from whoever was refused.
-
catreads the text and checksr. Only running by path checks running by path.
The refusal was on running by path, so the same run by the same user checks it. bash, sudo, and cat check other actions.
Key points
- You check a fix with the same operation, as the same user who was refused.
- After the check, compare the mode, owner, and group with the requirement: extra access is a mistake too.