Skip to content
stellvia.dev

Scheduled Execution

Inspect both cron and systemd timers for privileged scheduled tasks. Besides finding the timer, check which directories and environment variables its target reads.

See Processes and systemd for reading units. If a target reads a user-writable path, continue with Writable Paths Read by root.

Commands to check

Section titled “Commands to check”

Additional check examples:

Terminal window
cat /etc/crontab
ls -la /etc/cron.*
systemctl list-timers --all
systemctl cat <timer>
systemctl cat <service>
  • Purpose: Identify the executing user, schedule, invoked script, and paths on which the script depends.
  • Prerequisites: Some units and cron spools may be unreadable with ordinary user privileges.
  • What to inspect: Executing user, ExecStart, OnCalendar, PATH, working directory, relative paths, wildcards, and writable scripts and configuration.
  • Expected output: User=root, EnvironmentFile=/etc/<app>.env, or /bin/bash /opt/<app>/monitor.sh.
  • Interpretation: A root task that traverses a user-writable directory crosses a privilege boundary. Timer and service names do not necessarily match.
  • If a check fails: The timer may invoke a differently named service or a brief oneshot task; systemd may be absent inside a container; cron’s PATH may differ from expectations.
  • Alternative commands: ls -la /var/spool/cron /var/spool/cron/crontabs 2>/dev/null, grep -Rni <app> /etc/systemd /etc/cron* 2>/dev/null.
  • State change: Read-only.

A file written by a root timer and read by a sudo-run process can connect the two privilege boundaries. If no scheduled task appears or sudo is denied, inspect privileged localhost services as well. See Network and IPC for discovery.