T06 · System Persistence
Error
- Location
- references/cpu.md:95
- Finding
- Persistent Privileged System Tuning Without Sufficient Safety Controls<![CDATA[ ## Vulnerability Details **File Locations**: - `references/cpu.md:95-108` - `references/memory.md:144-158` - `references/disk_io.md:76-83` - `references/disk_io.md:109-113` - `references/disk_io.md:254-255` - `references/disk_io.md:314-318` - `SKILL.md:315-321` - `SKILL.md:357-361` **Vulnerability Type**: Persistent privileged system modification **Risk Level**: High ### Vulnerable Code CPU governor service: ```bash cat > /etc/systemd/system/cpu-performance.service << 'EOF' [Unit] Description=Set CPU governor to performance After=multi-user.target [Service] Type=oneshot ExecStart=/bin/bash -c "for f in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor; do echo performance > $f; done" RemainAfterExit=yes [Install] WantedBy=multi-user.target EOF systemctl enable --now cpu-performance.service ``` Transparent Huge Pages service: ```bash cat > /etc/systemd/system/disable-thp.service << 'EOF' [Unit] Description=Disable Transparent Huge Pages After=network.target [Service] Type=oneshot ExecStart=/bin/sh -c "echo never > /sys/kernel/mm/transparent_hugepage/enabled" ExecStart=/bin/sh -c "echo never > /sys/kernel/mm/transparent_hugepage/defrag" RemainAfterExit=yes [Install] WantedBy=multi-user.target EOF systemctl enable --now disable-thp.service ``` Persistent I/O scheduler rule: ```bash cat > /etc/udev/rules.d/60-ioscheduler.rules << 'EOF' # NVMe SSD ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/scheduler}="none" # SATA SSD ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="0", ATTR{queue/scheduler}="mq-deadline" # HDD ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="1", ATTR{queue/scheduler}="bfq" EOF udevadm control --reload-rules && udevadm trigger ``` Boot script replacement: ```bash cat > /etc/rc.local << 'EOF' #!/bin/bash blockdev --setra 4096 /dev/sda EOF chmod +x /etc/rc.local ``` Recurring disk tasks: ```bash systemctl enable fstrim.timer systemctl start fstrim.timer ``` ```bash systemctl ena ...[truncated 2513 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make read-only diagnosis the default behavior. 2. Require explicit, informed user approval immediately before every privileged or persistent operation. 3. Apply temporary settings first and observe them for a defined period before offering persistence. 4. Record the actual current values rather than assuming distribution defaults. 5. Never replace shared files such as `/etc/rc.local`; use a dedicated, narrowly scoped systemd unit or configuration drop-in. 6. Back up every modified file with ownership, mode, and timestamp preservation. 7. Validate the target device, kernel parameter, available scheduler, CPU governor, and service name before modification. 8. Provide complete rollback commands, including: - `systemctl disable --now <unit>` - Removal of the created unit. - `systemctl daemon-reload` - Removal or restoration of cron, udev, sysctl, and module-load entries. - Restoration of all captured runtime values. 9. Avoid appending duplicate entries to shared configuration files. 10. Add a dry-run mode that displays proposed changes and their scope without executing them. ]]>