Unit 6: Processes and services · Lesson 5 of 6 · 18 min
What starts at boot
Read systemd unit files to find what launches each service, as whom, and since when.
mission
- You are
- You are finding out how the fake kworker survives a reboot.
- Situation
- A process started by hand dies at reboot. Something must be starting it every time.
- Goal
- List enabled units and read the one that launches the fake kworker.
- Hand in
- The unit file name, its account and the time it was created.
List enabled units
This lab is a container, so systemd is not running, but its unit files are on disk exactly as on a real server.
systemctl list-unit-files --state=enabled --no-pager | grep -E 'service|timer'
cron.service enabled enabled
e2scrub_reap.service enabled enabled
getty@.service enabled enabled
kthreadd-helper.service enabled enabled
shop-status.service enabled enabled
systemd-pstore.service enabled enabled
apt-daily-upgrade.timer enabled enabled
apt-daily.timer enabled enabled
backup.timer enabled enabled
dpkg-db-backup.timer enabled enabled
e2scrub_all.timer enabled enabled
fstrim.timer enabled enabled
motd-news.timer enabled enabled
you should see Package units you can look up, two added by admins, and one with a very suspicious name.
Who and what each one runs
grep -H -E '^(User|ExecStart)=' /etc/systemd/system/*.service
/etc/systemd/system/backup.service:User=root
/etc/systemd/system/backup.service:ExecStart=/opt/scripts/report.sh
/etc/systemd/system/kthreadd-helper.service:User=dana
/etc/systemd/system/kthreadd-helper.service:ExecStart=/bin/bash -c 'exec -a "[kworker/0:2]" /usr/local/lib/.cache/kthreadd infinity'
/etc/systemd/system/shop-status.service:User=www-data
/etc/systemd/system/shop-status.service:ExecStart=/usr/bin/python3 /usr/local/lib/shop-status/status.py
you should see exec -a sets the fake name. The costume is written right into the unit file.
When did it appear
ls -l --time-style=long-iso /etc/systemd/system/*.service /etc/systemd/system/*.timer
-rw-r--r-- 1 root root 127 2026-10-14 09:00 /etc/systemd/system/backup.service
-rw-r--r-- 1 root root 127 2026-10-14 09:00 /etc/systemd/system/backup.timer
-rw-r--r-- 1 root root 224 2026-10-13 22:45 /etc/systemd/system/kthreadd-helper.service
-rw-r--r-- 1 root root 210 2026-10-14 09:00 /etc/systemd/system/shop-status.service
you should see 22:45 on 13 October, four minutes after the binary. A pattern is forming.
defender tip On a running server, systemctl cat name and systemctl status name show the unit and its live process together.
What a defender takes away
- 1Enabled units start at every boot.
- 2User= and ExecStart= tell you who runs what.
- 3Unit files in /etc/systemd/system were added by people. Review each one.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.