#!/bin/bash
# 探针1: 白名单文件 —— profile 中 /tmp/demo_sh.log rw, 应当成功
echo "[probe1] shell try write /tmp/demo_sh.log"
echo "shell write ok" > /tmp/demo_sh.log && echo "[probe1] write /tmp/demo_sh.log: ALLOWED"

# 探针2: 显式 deny —— deny /etc/shadow r, 静默拒绝
echo "[probe2] shell try read /etc/shadow"
cat /etc/shadow && echo "[probe2] read /etc/shadow: ALLOWED (unexpected!)"

# 探针3: 未列出的路径 —— 隐式默认拒绝, 记录 DENIED 日志
echo "[probe3] shell try write /tmp/demo_forbidden.log"
echo "should not be here" > /tmp/demo_forbidden.log && echo "[probe3] write /tmp/demo_forbidden.log: ALLOWED (unexpected!)"

exit 0