T06 · System Persistence
Error
- Location
SKILL.md:163- Finding
Persistent Execution Through a System-Wide systemd Service
- Content
View full analysis
/dev/null << 'SVC' [Unit] Description=Hermes Agent Gateway After=network-online.target Wants=network-online.target [Service] Type=simple User=$USER Group=$USER WorkingDirectory=/home/$USER/hermes-agent ExecStart=/home/$USER/hermes-agent/venv/bin/hermes gateway run --replace Environment=HOME=/home/$USER Environment=PATH=/home/$USER/hermes-agent/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin Environment=HERMES_HOME=/home/$USER/.hermes Restart=on-failure RestartSec=15 KillMode=mixed KillSignal=SIGTERM TimeoutStopSec=30 StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target SVC sudo systemctl daemon-reload sudo systemctl enable hermes-gateway.service sudo systemctl start hermes-gateway.service ``` ### Technical Analysis The instructions use elevated privileges to write a system-wide service definition under `/etc/systemd/system`, enable it at boot, and immediately start it. The service automatically restarts on failure and survives both termination of the deployment session and system reboots. Persistent operation is consistent with the Skill's declared purpose of running a gateway continuously. Nevertheless, it creates a durable execution mechanism for code installed from an external repository. The service launches an executable from a user-controlled working tree and virtual environment. If that executable, its dependencies, or the working tree is subsequently compromised, the changed code will execute whenever the service starts or restarts. The service runs as the configured non-root user rather than as root, which reduces direct impact. However, root privileges are still used to register and manage the service, and no meaningful systemd sandboxing restrictions are applied. ...[truncated 983 chars]- Remediation
View remediation