T06 · System Persistence
Warning
- Location
install.sh:133- Finding
Unconditional Installation of a System-Wide Persistence Definition
- Content
View full analysis
"$service_file" << EOF [Unit] Description=FC Online website monitoring service After=network.target [Service] Type=simple User=$USER WorkingDirectory=/root/.openclaw/workspace/skills/fco-monitor ExecStart=/usr/bin/node openclaw-integration.js check-now Restart=on-failure RestartSec=10 [Install] WantedBy=multi-user.target EOF echo "Service file created: $service_file" echo "Use the following commands to enable the service:" echo " sudo systemctl daemon-reload" echo " sudo systemctl enable fco-monitor" echo " sudo systemctl start fco-monitor" } ``` The installer invokes this function without an option or confirmation: ```bash # Create service (optional) create_service ``` ### Technical Analysis The installer labels service creation as optional, but `create_service` is always called by the main installation flow. It writes a unit directly to `/etc/systemd/system/fco-monitor.service`, which is a system-wide persistence location and normally requires root privileges. The unit does not hard-code a dedicated, restricted service account. Instead, it uses `User=$USER`. When the installer is run as root—as encouraged by its hard-coded `/root` paths and required by the write to `/etc/systemd/system`—the generated service can be configured to execute as root. Although the installer does not automatically execute `systemctl enable` or `systemctl start`, it leaves a dormant system-wide persisten ...[truncated 1925 chars]- Remediation
View remediation