Locking the script down

Take away the write bits

The script is already owned by root; the danger is that everyone can write it. Remove group and other write access with chmod:

sudo chmod 755 /opt/backup/backup.sh
ls -l /opt/backup/backup.sh

In the terminal (now rwxr-xr-x — only root can edit it; everyone can still read and run it)

student@vulntech:~$ sudo chmod 755 /opt/backup/backup.sh
[sudo] password for student:
student@vulntech:~$ ls -l /opt/backup/backup.sh
-rwxr-xr-x 1 root root 79 Oct 19 10:32 /opt/backup/backup.sh

Root still runs its backup, but no ordinary user can change what it does. The code-execution path is closed. (750 or 700 would be tighter still if the file need not be world-readable.)