[Change] coreutils: command cat prefix across 26 bare cat sites — el6 PATH portability

rfxn · rfxn · commit 66701f6e97df · 2026-05-24T13:49:20.000-05:00
Project Shell Standards (parent CLAUDE.md) require `command` prefix on
all coreutils in project source to resolve via PATH for portability
across pre-usr-merge distros (CentOS 6 has /bin/cat, not /usr/bin/cat).
This commit closes the bare-`cat` advisory item carried in MEMORY since
2026-04-06.

26 sites across 11 files:
  files/internals/lmd_alert.sh        7 sites
  files/internals/lmd_sigs.sh         7 sites
  files/internals/lmd_session.sh      8 sites
  files/internals/lmd_monitor.sh      4 sites
  files/internals/lmd_quarantine.sh   4 sites
  files/internals/lmd_scan.sh         3 sites
  files/internals/lmd_update.sh       4 sites
  files/internals/lmd_engine.sh       1 site
  files/internals/lmd_config.sh       1 site
  files/maldet                        1 site
  install.sh                          1 site

Forms covered: anchored `cat "$f" &gt; "$o"` (statement-level),
`$(cat "$f")` (subshell capture), `$(cat "$f" 2&gt;/dev/null)`
(suppression-wrapped), `&amp;&amp; cat "$f" &gt;&gt; "$o"` (mid-line after &amp;&amp;),
heredoc-substitution `$(cat "$f")` (inside double-quoted strings).
Word-boundary grep `\bcat\b | grep -v 'command cat'` now empty
across LMD source — only `files/maldet:240 cat&lt;&lt;EOF` remains, which
is the heredoc form exempt by project rule and project verification
grep (`^\s*cat\s(?!&lt;&lt;)`).

Vendored libraries (alert_lib.sh:309, tlog_lib.sh:441) unchanged —
fix upstream, not in-tree. No functional change; bash -n passes
across all touched files.
diff --git a/CHANGELOG b/CHANGELOG
@@ -27,6 +27,12 @@ v2.0.2 | May 12 2026:
          as the earlier comment-discipline commit cdd0814); closes the
          attacker-writable manifest vector against root-startup invocation
          of pkg_fhs_verify_farm from files/maldet:78
+[Change] coreutils: `command cat` prefix on 26 bare `cat` sites across 9
+         files (lmd_alert, lmd_config, lmd_engine, lmd_monitor, lmd_quarantine,
+         lmd_scan, lmd_session, lmd_sigs, lmd_update, files/maldet, install.sh)
+         — el6 PATH portability per project Shell Standards; closes the
+         advisory item carried in MEMORY since 2026-04-06. Heredoc form
+         (`cat<<EOF`) and vendored libraries (alert_lib, tlog_lib) unchanged
 
   -- Bug Fixes --
 
diff --git a/CHANGELOG.RELEASE b/CHANGELOG.RELEASE
@@ -27,6 +27,12 @@ v2.0.2 | May 12 2026:
          as the earlier comment-discipline commit cdd0814); closes the
          attacker-writable manifest vector against root-startup invocation
          of pkg_fhs_verify_farm from files/maldet:78
+[Change] coreutils: `command cat` prefix on 26 bare `cat` sites across 9
+         files (lmd_alert, lmd_config, lmd_engine, lmd_monitor, lmd_quarantine,
+         lmd_scan, lmd_session, lmd_sigs, lmd_update, files/maldet, install.sh)
+         — el6 PATH portability per project Shell Standards; closes the
+         advisory item carried in MEMORY since 2026-04-06. Heredoc form
+         (`cat<<EOF`) and vendored libraries (alert_lib, tlog_lib) unchanged
 
   -- Bug Fixes --
 
diff --git a/files/internals/lmd_alert.sh b/files/internals/lmd_alert.sh
@@ -164,10 +164,10 @@ To enable, set <code style=\"font-family:'Courier New',Courier,monospace;font-si
 		fi
 		if [ -f "$_clist" ]; then
 			CLEANED_SECTION_TEXT="CLEANED & RESTORED FILES:
-$(cat "$_clist")
+$(command cat "$_clist")
 "
 			local _clist_html
-			_clist_html=$(_alert_html_escape "$(cat "$_clist")")
+			_clist_html=$(_alert_html_escape "$(command cat "$_clist")")
 			CLEANED_SECTION_HTML="<table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\" style=\"margin-bottom:12px;\">
 <tr><td style=\"color:#71717a;font-size:12px;text-transform:uppercase;letter-spacing:1px;padding-bottom:6px;\">Cleaned &amp; Restored Files</td></tr>
 <tr><td style=\"font-family:'Courier New',Courier,monospace;font-size:12px;color:#09090b;background-color:#f4f4f5;padding:8px 12px;border-radius:4px;border:1px solid #d4d4d8;word-break:break-all;\">${_clist_html//$'\n'/<br>}</td></tr></table>"
@@ -186,10 +186,10 @@ $(cat "$_clist")
 		fi
 		if [ -f "$_slist" ]; then
 			SUSPENDED_SECTION_TEXT="SUSPENDED ACCOUNTS:
-$(cat "$_slist")
+$(command cat "$_slist")
 "
 			local _slist_html
-			_slist_html=$(_alert_html_escape "$(cat "$_slist")")
+			_slist_html=$(_alert_html_escape "$(command cat "$_slist")")
 			SUSPENDED_SECTION_HTML="<table role=\"presentation\" cellpadding=\"0\" cellspacing=\"0\" border=\"0\" width=\"100%\" style=\"margin-bottom:12px;\">
 <tr><td style=\"color:#71717a;font-size:12px;text-transform:uppercase;letter-spacing:1px;padding-bottom:6px;\">Suspended Accounts</td></tr>
 <tr><td style=\"font-family:'Courier New',Courier,monospace;font-size:12px;color:#09090b;background-color:#f4f4f5;padding:8px 12px;border-radius:4px;border:1px solid #d4d4d8;\">${_slist_html//$'\n'/<br>}</td></tr></table>"
@@ -1222,7 +1222,7 @@ trim_log() {
 			local tmplog
 			tmplog=$(mktemp "${log}.trim.XXXXXX")
 			tail -n +"$((trim + 1))" "$log" > "$tmplog" 2>/dev/null
-			cat "$tmplog" > "$log" 2>/dev/null
+			command cat "$tmplog" > "$log" 2>/dev/null
 			command rm -f "$tmplog"
 		fi
 	elif [ ! -f "$log" ] && [ "$3" == "1" ]; then
@@ -1566,7 +1566,7 @@ _genalert_digest() {
 
 	# Monitor tlog sources — only read when monitor session is active
 	if [ "$_has_monitor" -eq 1 ]; then
-		scan_session=$(cat "$sessdir/session.monitor.current")
+		scan_session=$(command cat "$sessdir/session.monitor.current")
 		tlog_read "$scan_session" "digest.alert" "$tmpdir" "lines" > "$tmpdir/.digest.alert.hits"
 		tlog_read "$clean_history" "digest.clean.alert" "$tmpdir" "lines" > "$tmpdir/.digest.clean.hits"
 		tlog_read "$monitor_scanned_history" "digest.monitor.alert" "$tmpdir" "lines" > "$tmpdir/.digest.monitor.alert"
@@ -1861,7 +1861,7 @@ _test_alert_digest() {
 	local _had_cursor=0 _cursor_backup=""
 	if [ -f "$_cursor_file" ]; then
 		_had_cursor=1
-		_cursor_backup=$(cat "$_cursor_file")
+		_cursor_backup=$(command cat "$_cursor_file")
 	fi
 
 	local _now
diff --git a/files/internals/lmd_config.sh b/files/internals/lmd_config.sh
@@ -377,7 +377,7 @@ import_conf() {
 		import_config_expire=43200
 	fi
 	if [ -f "$sessdir/.import_conf.utime" ]; then
-		import_utime=$(cat "$sessdir/.import_conf.utime")
+		import_utime=$(command cat "$sessdir/.import_conf.utime")
 		if [ -z "$import_utime" ]; then
 			import_utime="0"
 		fi
diff --git a/files/internals/lmd_engine.sh b/files/internals/lmd_engine.sh
@@ -473,7 +473,7 @@ _hex_csig_batch_worker() {
 					if [ -n "${_uni_sids[$_elem]:-}" ]; then
 						seq 1 "$_total_files"
 					elif [ -s "${_match_dir}/${_elem}" ]; then
-						cat "${_match_dir}/${_elem}"
+						command cat "${_match_dir}/${_elem}"
 					fi
 				done | sort -n | uniq -c | awk -v thresh="$_threshold" \
 					'$1 >= thresh {print $2}' > "$_or_merge"
diff --git a/files/internals/lmd_monitor.sh b/files/internals/lmd_monitor.sh
@@ -440,7 +440,7 @@ _monitor_cycle_tick() {
 	fi
 
 	# Record scanned files in monitor history
-	cat "$_filtered_list" >> "$monitor_scanned_history" 2>/dev/null  # safe: file may not exist yet
+	command cat "$_filtered_list" >> "$monitor_scanned_history" 2>/dev/null  # safe: file may not exist yet
 
 	# Count per-cycle hits (delta since pre-scan snapshot)
 	local _post_scan_lines _cycle_hits
@@ -468,7 +468,7 @@ monitor_kill() {
 	# Called by maldet -k/--kill-monitor.
 	local _pid
 	if [ -f "$tmpdir/monitor.pid" ]; then
-		_pid=$(cat "$tmpdir/monitor.pid")
+		_pid=$(command cat "$tmpdir/monitor.pid")
 	fi
 	if [ -z "$_pid" ] || ! kill -0 "$_pid" 2>/dev/null; then
 		# Fallback: find by inotifywait process (old-style)
@@ -524,7 +524,7 @@ monitor_init() {
 	# Check for existing monitor
 	if [ -f "$tmpdir/monitor.pid" ]; then
 		local _existing_pid
-		_existing_pid=$(cat "$tmpdir/monitor.pid")
+		_existing_pid=$(command cat "$tmpdir/monitor.pid")
 		if [ -n "$_existing_pid" ] && kill -0 "$_existing_pid" 2>/dev/null; then
 			eout "{mon} existing monitor process detected (pid: $_existing_pid, try -k)" 1
 			exit 1
@@ -544,8 +544,8 @@ monitor_init() {
 	# Kernel tuning
 	if [ -f "/proc/sys/fs/inotify/max_user_instances" ] && [ -f "/proc/sys/fs/inotify/max_user_watches" ]; then
 		local cur_user_watches cur_user_instances users_tot inotify_user_watches
-		cur_user_watches=$(cat /proc/sys/fs/inotify/max_user_watches)
-		cur_user_instances=$(cat /proc/sys/fs/inotify/max_user_instances)
+		cur_user_watches=$(command cat /proc/sys/fs/inotify/max_user_watches)
+		cur_user_instances=$(command cat /proc/sys/fs/inotify/max_user_instances)
 		users_tot=$(awk -F: -v min="$inotify_minuid" '$3 >= min {n++} END {print n+0}' /etc/passwd)
 		inotify_user_watches=$((inotify_base_watches * users_tot))
 		if [ "$cur_user_instances" -lt "$inotify_user_instances" ]; then
diff --git a/files/internals/lmd_quarantine.sh b/files/internals/lmd_quarantine.sh
@@ -561,9 +561,9 @@ _batch_record_hits() {
 	}' "$_enriched" > "$_sess_block"
 
 	# Append in bulk writes
-	cat "$_hist_block" >> "$hits_history"
+	command cat "$_hist_block" >> "$hits_history"
 	if [ -n "$scan_session" ]; then
-		cat "$_sess_block" >> "$scan_session"
+		command cat "$_sess_block" >> "$scan_session"
 	fi
 
 	# Summary eout — one line instead of N
@@ -690,7 +690,7 @@ _batch_quarantine() {
 	fi
 
 	# Update quarantine history and scan_session (overwrite non-quarantine entries)
-	cat "$_quar_hist_block" >> "$quar_history"
+	command cat "$_quar_hist_block" >> "$quar_history"
 
 	# Update scan_session: set field 3 (quarpath) for quarantined files.
 	# Build lookup from _quar_sess_block (only successfully quarantined files),
@@ -705,7 +705,7 @@ _batch_quarantine() {
 		/^#/ { print; next }
 		{ if ($2 in quar) $3 = quar[$2]; print }
 		' "$_quar_lookup" "$scan_session" > "$_updated_sess"
-		cat "$_updated_sess" > "$scan_session"
+		command cat "$_updated_sess" > "$scan_session"
 		command rm -f "$_quar_lookup" "$_updated_sess"
 	fi
 
diff --git a/files/internals/lmd_scan.sh b/files/internals/lmd_scan.sh
@@ -335,7 +335,7 @@ _wait_workers_with_progress() {
 		if [ -d "$_progress_dir" ]; then
 			for _wpath in "$_progress_dir"/*; do
 				if [ -f "$_wpath" ]; then
-					_wval=$(cat "$_wpath" 2>/dev/null)
+					_wval=$(command cat "$_wpath" 2>/dev/null)
 					if [ -n "$_wval" ] && [ "$_wval" -gt 0 ] 2>/dev/null; then
 						_processed=$((_processed + _wval))
 					fi
@@ -629,7 +629,7 @@ _scan_run_native() {
 				if [ -s "$_hash_hit_paths" ]; then
 					grep -vFxf "$_hash_hit_paths"
 				else
-					cat
+					command cat
 				fi
 			} > "$_sha256_batch_flist"
 			command rm -f "$_hash_hit_paths"
@@ -709,7 +709,7 @@ _scan_run_native() {
 			if [ -s "$_hash_hit_paths" ]; then
 				grep -vFxf "$_hash_hit_paths"
 			else
-				cat
+				command cat
 			fi
 		} > "$_hex_filelist"
 		command rm -f "$_hash_hit_paths"
@@ -804,7 +804,7 @@ _scan_run_native() {
 		_hex_manifest=$(mktemp "$tmpdir/.hex_manifest.$$.XXXXXX")
 		for _wout in "${_worker_outputs[@]}"; do
 			if [ -f "$_wout" ] && [ -s "$_wout" ]; then
-				cat "$_wout" >> "$_hex_manifest"
+				command cat "$_wout" >> "$_hex_manifest"
 			fi
 		done
 		_flush_hit_batch "$_hex_manifest" "$_hex_stage_label"
diff --git a/files/internals/lmd_session.sh b/files/internals/lmd_session.sh
@@ -73,7 +73,7 @@ _session_write_header() {
 	local _hostname _hostid_val _sig_ver_val _engine_val
 	_hostname=$(hostname)
 	_hostid_val="${hostid:--}"
-	_sig_ver_val="${sig_version:-$(cat "$sigdir/maldet.sigs.ver" 2>/dev/null || echo "-")}"  # safe: fallback provides sentinel when sigs.ver missing
+	_sig_ver_val="${sig_version:-$(command cat "$sigdir/maldet.sigs.ver" 2>/dev/null || echo "-")}"  # safe: fallback provides sentinel when sigs.ver missing
 	# Determine engine — scan_clamscan=1 means ClamAV was used as the primary engine.
 	# Native engine always runs hash+hex passes; ClamAV replaces them when enabled.
 	# Both never run simultaneously in current architecture.
@@ -130,7 +130,7 @@ _session_legacy_check() {
 	# auto mode: check cache first
 	if [ -f "$sessdir/.session_format" ]; then
 		local _cached
-		_cached=$(cat "$sessdir/.session_format")
+		_cached=$(command cat "$sessdir/.session_format")
 		case "$_cached" in
 			v1)     _session_legacy_active=0; return ;;
 			legacy) _session_legacy_active=1; return ;;
@@ -464,7 +464,7 @@ view_report() {
 	# RESOLVE RID (newest/empty)
 	if [ "$rid" == "newest" ] || [ "$rid" == "latest" ] || [ "$rid" == "" ]; then
 		if [ -f "$sessdir/session.last" ]; then
-			rid=$(cat "$sessdir/session.last")
+			rid=$(command cat "$sessdir/session.last")
 		else
 			eout "{report} no recent scan session found" 1
 			exit 1
@@ -519,7 +519,7 @@ view_report() {
 			_alert_deliver_email "$_mailto" "$email_subj" "$_json_tmp" "" "text"
 			eout "{report} JSON report ID $rid sent to $_mailto" 1
 		else
-			cat "$_json_tmp"
+			command cat "$_json_tmp"
 		fi
 		command rm -f "$_json_tmp"
 		exit 0
@@ -573,7 +573,7 @@ view_report() {
 		local _html=""
 		_resolve_html_for_session "$_report_file"
 		if [ -n "$_html" ]; then
-			cat "$_html"
+			command cat "$_html"
 			command rm -f "$_html"
 		else
 			eout "{report} HTML rendering unavailable" 1
@@ -592,7 +592,7 @@ view_report() {
 		_lmd_render_text "$_manifest" "scan" "$_tpl_dir"
 		command rm -f "$_manifest"
 	else
-		cat "$_report_file"
+		command cat "$_report_file"
 	fi
 	[ -n "$_vr_tmp_session" ] && command rm -f "$_vr_tmp_session"
 	exit 0
@@ -622,7 +622,7 @@ _inotify_trim_log() {
 	local tmplog
 	tmplog=$(mktemp "${inotify_log}.trim.XXXXXX")
 	tail -n +"$((_trim + 1))" "$inotify_log" > "$tmplog" 2>/dev/null
-	cat "$tmplog" > "$inotify_log" 2>/dev/null
+	command cat "$tmplog" > "$inotify_log" 2>/dev/null
 	command rm -f "$tmplog"
 	eout "{mon} inotify log file trimmed"
 }
@@ -686,7 +686,7 @@ _scan_finalize_session() {
 	# Write header + hit data to TSV
 	_session_write_header "$nsess_hits" "scan"
 	# Append hit records (scan_session has no header during in-flight scan)
-	cat "$scan_session" >> "$nsess_hits"
+	command cat "$scan_session" >> "$nsess_hits"
 
 	_lmd_elk_post_hits "$nsess_hits"
 
@@ -707,7 +707,7 @@ _scan_finalize_session() {
 	# sig_version: prefer runtime $sig_version; fall back to on-disk sigs.ver sentinel.
 	# engine derivation mirrors _session_write_header at lines 83-87.
 	local _idx_sig_ver _idx_quar_en _idx_completed_hr _idx_engine _idx_hashtype
-	_idx_sig_ver="${sig_version:-$(cat "$sigdir/maldet.sigs.ver" 2>/dev/null || echo "-")}"  # safe: sigs.ver may be absent on fresh install
+	_idx_sig_ver="${sig_version:-$(command cat "$sigdir/maldet.sigs.ver" 2>/dev/null || echo "-")}"  # safe: sigs.ver may be absent on fresh install
 	_idx_quar_en="${quarantine_hits:-0}"
 	_idx_completed_hr="${scan_end_hr:--}"
 	if [ "${scan_clamscan:-0}" = "1" ]; then
diff --git a/files/internals/lmd_sigs.sh b/files/internals/lmd_sigs.sh
@@ -549,12 +549,12 @@ gensigs() {
 	if [ -s "$sig_user_hex_file" ]; then
 		grep -h -vE '^\s*$' "$sig_hex_file" "$sig_user_hex_file" > "$runtime_hexstrings"
 	else
-		cat "$sig_hex_file" > "$runtime_hexstrings"
+		command cat "$sig_hex_file" > "$runtime_hexstrings"
 	fi
 	if [ -s "$sig_user_md5_file" ]; then
 		grep -h -vE '^\s*$' "$sig_md5_file" "$sig_user_md5_file" > "$runtime_md5"
 	else
-		cat "$sig_md5_file" > "$runtime_md5"
+		command cat "$sig_md5_file" > "$runtime_md5"
 	fi
 	# SHA-256 runtime sigs — conditional on effective hashtype
 	runtime_sha256=""
@@ -564,7 +564,7 @@ gensigs() {
 			if [ -s "$sig_user_sha256_file" ]; then
 				grep -h -vE '^\s*$' "$sig_sha256_file" "$sig_user_sha256_file" > "$runtime_sha256"
 			else
-				cat "$sig_sha256_file" > "$runtime_sha256"
+				command cat "$sig_sha256_file" > "$runtime_sha256"
 			fi
 		elif [ -s "$sig_user_sha256_file" ]; then
 			# Upgrade path: no base sha256v2.dat yet, only custom sigs
@@ -586,7 +586,7 @@ gensigs() {
 					echo "{HEX}$name:0:*:$hex" >> "$runtime_ndb"
 				fi
 			done < <(sed 's/{HEX}//' "$sig_user_hex_file" | tr ':' '%' | grep -vE "^\s*$")
-			cat "$sig_cav_hex_file" >> "$runtime_ndb"
+			command cat "$sig_cav_hex_file" >> "$runtime_ndb"
 		else
 			command cp "$sig_cav_hex_file" "$runtime_ndb"
 		fi
@@ -595,7 +595,7 @@ gensigs() {
 			if [ -s "$sig_user_md5_file" ]; then
 				# Convert user MD5 sigs from LMD format (HASH:SIZE:{MD5}name) to ClamAV .hdb format (HASH:SIZE:name)
 				sed 's/{MD5}//' "$sig_user_md5_file" | grep -vE "^\s*$" > "$runtime_hdb"
-				cat "$sig_cav_md5_file" >> "$runtime_hdb"
+				command cat "$sig_cav_md5_file" >> "$runtime_hdb"
 			else
 				command cp "$sig_cav_md5_file" "$runtime_hdb"
 			fi
@@ -606,7 +606,7 @@ gensigs() {
 			runtime_hsb=$(mktemp "$tmpdir/.runtime.user.hsb.$scanid.XXXXXX")
 			if [ -s "$sig_user_sha256_file" ]; then
 				sed 's/{SHA256}//' "$sig_user_sha256_file" | grep -vE "^\s*$" > "$runtime_hsb"
-				[ -f "$sig_cav_sha256_file" ] && [ -s "$sig_cav_sha256_file" ] && cat "$sig_cav_sha256_file" >> "$runtime_hsb"
+				[ -f "$sig_cav_sha256_file" ] && [ -s "$sig_cav_sha256_file" ] && command cat "$sig_cav_sha256_file" >> "$runtime_hsb"
 			elif [ -f "$sig_cav_sha256_file" ] && [ -s "$sig_cav_sha256_file" ]; then
 				command cp "$sig_cav_sha256_file" "$runtime_hsb"
 			else
@@ -689,7 +689,7 @@ gensigs() {
 			if [ -f "$sig_user_csig_file" ] && [ -s "$sig_user_csig_file" ]; then
 				grep -h -vE '^\s*$' "$sig_csig_file" "$sig_user_csig_file" > "$_runtime_csig"
 			else
-				cat "$sig_csig_file" > "$_runtime_csig"
+				command cat "$sig_csig_file" > "$_runtime_csig"
 			fi
 		elif [ -f "$sig_user_csig_file" ] && [ -s "$sig_user_csig_file" ]; then
 			grep -vE '^\s*$' "$sig_user_csig_file" > "$_runtime_csig"
diff --git a/files/internals/lmd_update.sh b/files/internals/lmd_update.sh
@@ -177,8 +177,8 @@ lmdup() {
 			get_remote_file "$_hash_remote_url" "update" "1"
 			upstreamhash="$return_file"
 			if [ -s "$upstreamhash" ]; then
-				installed_hash=$(cat "$lmd_hash_file")
-				current_hash=$(cat "$upstreamhash")
+				installed_hash=$(command cat "$lmd_hash_file")
+				current_hash=$(command cat "$upstreamhash")
 				if [ "$installed_hash" != "$current_hash" ]; then
 					eout "{update} version check shows latest but hash check failed, forcing update..." 1
 					doupdate=1
@@ -239,7 +239,7 @@ lmdup() {
 				eout "{update} install.sh failed with exit code $install_rc" 1
 				_lmd_elog_event "$ELOG_EVT_UPDATE_FAILED" "error" "version update failed" "action=lmdup" "reason=install_failed" "rc=$install_rc"
 				if [ -s "$install_log" ]; then
-					eout "{update} install.sh output: $(cat "$install_log")" 0
+					eout "{update} install.sh output: $(command cat "$install_log")" 0
 				fi
 				command rm -f "$install_log"
 				cd "$inspath" ; command rm -rf "$tmpwd"
@@ -300,7 +300,7 @@ sigup() {
 		clean_exit
 		exit 1
 	else
-		nver=$(cat "$upstream_sigver")
+		nver=$(command cat "$upstream_sigver")
 	fi
 
 	if [ ! -f "$sig_md5_file" ] || [ ! -f "$sig_hex_file" ]; then
diff --git a/files/maldet b/files/maldet
@@ -663,7 +663,7 @@ else
 					systemctl stop maldet.service
 				else
 					if [ -f "$tmpdir/monitor.pid" ]; then
-						_mpid=$(cat "$tmpdir/monitor.pid")
+						_mpid=$(command cat "$tmpdir/monitor.pid")
 						if [ -n "$_mpid" ] && kill -0 "$_mpid" 2>/dev/null; then
 							eout "{mon} sending stop to monitor supervisor (pid: $_mpid)" 1
 							monitor_kill
diff --git a/install.sh b/install.sh
@@ -144,7 +144,7 @@ _install_cron_service() {
 
 	if [ "$(uname -s)" != "FreeBSD" ]; then
 		pkg_detect_os
-		_init_system=$(cat /proc/1/comm 2>/dev/null)
+		_init_system=$(command cat /proc/1/comm 2>/dev/null)
 		if test "$_init_system" == "systemd"; then
 			pkg_service_install maldet ./files/service/maldet.service
 			systemctl enable maldet.service 2>/dev/null  # safe: idempotent
