T06 · System Persistence
Error
- Location
- install.sh:52
- Finding
- Persistent Automatic Execution Through systemd Hooks and Scheduled Agent Events<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:52-92`; related execution logic in `scripts/boot-resume-check.sh:185-200` **Vulnerability Type**: T06: System Persistence **Risk Level**: High ### Vulnerable Code ```bash # 2. Deploy systemd drop-in (Linux only) if [[ "$(uname)" == "Linux" ]]; then SYSTEMD_DROPIN_DIR="$HOME/.config/systemd/user/openclaw-gateway.service.d" DROPIN_TARGET="$SYSTEMD_DROPIN_DIR/boot-resume.conf" mkdir -p "$SYSTEMD_DROPIN_DIR" if [[ -f "$DROPIN_TARGET" ]]; then echo " boot-resume.conf already exists." read -rp " Overwrite? [y/N] " answer if [[ "${answer,,}" != "y" ]]; then echo " Skipped drop-in deployment." else cp "$SKILL_DIR/templates/boot-resume.conf" "$DROPIN_TARGET" echo "✓ Updated systemd drop-in" fi else cp "$SKILL_DIR/templates/boot-resume.conf" "$DROPIN_TARGET" echo "✓ Deployed systemd drop-in → $SYSTEMD_DROPIN_DIR/" fi # 2b. Deploy sleep/wake service (triggers on system resume from suspend/hibernate) WAKE_SERVICE_DIR="$HOME/.config/systemd/user" WAKE_SERVICE_TARGET="$WAKE_SERVICE_DIR/boot-resume-wake.service" if [[ -f "$WAKE_SERVICE_TARGET" ]]; then echo " boot-resume-wake.service already exists." read -rp " Overwrite? [y/N] " answer if [[ "${answer,,}" != "y" ]]; then echo " Skipped wake service deployment." else cp "$SKILL_DIR/templates/boot-resume-wake.service" "$WAKE_SERVICE_TARGET" echo "✓ Updated wake service" fi else cp "$SKILL_DIR/templates/boot-resume-wake.service" "$WAKE_SERVICE_TARGET" echo "✓ Deployed wake service → $WAKE_SERVICE_DIR/" fi # Reload systemd and enable wake service systemctl --user daemon-reload 2>/dev/null && echo "✓ Reloaded systemd" || echo "⚠ systemctl daemon-reload failed" systemctl --user enable boot-resume-wake.service 2>/dev/null && echo "✓ Enabled wake service" || echo "⚠ Could not enable wake service" ``` The persistently invoked script the ...[truncated 4074 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make manual, non-persistent invocation the default behavior. 2. Require explicit, separate consent before installing each systemd component or enabling any service. 3. Include the referenced systemd unit files in the package so their exact commands, environment, and security properties can be audited. 4. Display the complete unit contents and target paths before installation. 5. Verify ownership and restrictive permissions for the installed script, systemd files, workspace directories, and parent directories. 6. Configure systemd hardening where compatible, including filesystem restrictions, private temporary storage, restricted address families, and minimal environment exposure. 7. Pin the service to a protected script path and validate the script's integrity before every execution. 8. Limit session scanning to an explicit allowlist of agents rather than all agent directories. 9. Require confirmation or an authenticated pending-recovery marker before injecting a continuation event. 10. Implement reliable deduplication and record which interruption has already been processed to prevent repeated or unintended injections. 11. Provide an uninstall command that disables and removes every persistent component before reloading systemd. 12. Fail installation before making any changes when required templates or dependencies are absent, and roll back partial modifications on failure. ]]>