Skip to content
stellvia.dev

Processes and systemd

Check which user runs each process and which configuration, working directory, and environment variables it uses. Do not rely only on a user specified in code; inspect how the process actually starts.

See Network and IPC for listeners and sockets, and Credentials and Configuration for credentials indicated by units.

Commands to check

Section titled “Commands to check”

Additional check examples:

Terminal window
ps auxf
ps -eo user,pid,ppid,group,cmd --forest
systemctl --type=service --state=running
systemctl status <service>
systemctl cat <service>
systemctl show <service>
cat /proc/<PID>/status
tr '\0' '\n' < /proc/<PID>/environ
tr '\0' ' ' < /proc/<PID>/cmdline
readlink -f /proc/<PID>/exe
ls -l /proc/<PID>/fd
  • Purpose: Inspect executing users, startup commands, parent-child relationships, actual unit settings, and open file descriptors.
  • Prerequisites: systemd may not be present. /proc/<PID>/environ and fd may be unreadable without the same user identity or elevated privileges.
  • What to inspect: User=, Group=, ExecStart=, Environment=, EnvironmentFile=, WorkingDirectory=, PID 1, and open file descriptors.
  • Expected output: root ... php -S 127.0.0.1:<port> -t /var/www/<app>, ExecStart=/usr/local/bin/<service>, or a oneshot service with User=root.
  • Interpretation: A service running as root that reads user-controlled input crosses a privilege boundary. If several similar configuration files exist, use systemctl cat and /proc/<PID>/cmdline to determine which one is actually used.
  • If a check fails: Consider absence of systemctl, a container environment, insufficient privileges, a different service name, a short-lived process, or the hidepid mount option.
  • Alternative commands: service --status-all, initctl, pgrep -a <name>, strings /proc/<PID>/environ 2>/dev/null.
  • State change: Read-only. systemctl status may start a pager, so use SYSTEMD_PAGER=cat or --no-pager.

Interpretation

Section titled “Interpretation”
  • Code alone does not reveal the executing user. Some operations have a different impact when run as root.
  • /proc/<PID>/fd can reveal file descriptors that bypass path permissions. See Unix Sockets and File Descriptors for details.
  • EnvironmentFile may contain credentials or administrative passwords. If readable, inspect only the relevant files.
  • Inability to read /proc/<PID>/environ or fd is itself information about a boundary.

Use systemctl cat to identify the actual ExecStart and unit file location, distinguishing sample settings from production settings. A localhost admin UI and a root timer may use different units even for the same application. For a built-in development HTTP server, the document root in /proc/<PID>/cmdline shows which files that process serves. If you find a language runtime debug port, record its PID, command line, and UID together.

ExecStart, User, Group, EnvironmentFile, and WorkingDirectory indicate which files and privilege boundaries to examine next. See Scheduled Execution for timer relationships.