T06 · System Persistence
Error
- Location
references/cpu.md:95- Finding
Persistent Privileged System Tuning Without Sufficient Safety Controls
- Content
View full analysis
/etc/systemd/system/cpu-performance.service << 'EOF' [Unit] Description=Set CPU governor to performance After=multi-user.target [Service] Type=oneshot ExecStart=/bin/bash -c "for f in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor; do echo performance > $f; done" RemainAfterExit=yes [Install] WantedBy=multi-user.target EOF systemctl enable --now cpu-performance.service ``` Transparent Huge Pages service: ```bash cat > /etc/systemd/system/disable-thp.service << 'EOF' [Unit] Description=Disable Transparent Huge Pages After=network.target [Service] Type=oneshot ExecStart=/bin/sh -c "echo never > /sys/kernel/mm/transparent_hugepage/enabled" ExecStart=/bin/sh -c "echo never > /sys/kernel/mm/transparent_hugepage/defrag" RemainAfterExit=yes [Install] WantedBy=multi-user.target EOF systemctl enable --now disable-thp.service ``` Persistent I/O scheduler rule: ```bash cat > /etc/udev/rules.d/60-ioscheduler.rules << 'EOF' # NVMe SSD ACTION=="add|change", KERNEL=="nvme[0-9]*", ATTR{queue/scheduler}="none" # SATA SSD ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="0", ATTR{queue/scheduler}="mq-deadline" # HDD ACTION=="add|change", KERNEL=="sd[a-z]", ATTR{queue/rotational}=="1", ATTR{queue/scheduler}="bfq" EOF udevadm control --reload-rules && udevadm trigger ``` Boot script replacement: ```bash cat > /etc/rc.local << 'EOF' #!/bin/bash blockdev --setra 4096 /dev/sda EOF chmod +x /etc/rc.local ``` Recurring disk tasks: ```bash systemctl enable fstrim.timer systemctl start fstrim.timer ``` ```bash systemctl ena ...[truncated 2513 chars]- Remediation
View remediation
` - Removal of the created unit. - `systemctl daemon-reload` - Removal or restoration of cron, udev, sysctl, and module-load entries. - Restoration of all captured runtime values. 9. Avoid appending duplicate entries to shared configuration files. 10. Add a dry-run mode that displays proposed changes and their scope without executing them. ]]>