Lesson 1.46: Writable paths in root's jobs
Root runs things all day: cron jobs, systemd services, maintenance scripts. If any file or directory on the way to those programs is writable by someone else, that someone can make root run their code. The usual suspects are a world-writable directory early in PATH, a script owned by a developer group, and service code owned by the service account. In the lab you trace what root executes on Northwind's order server, find the writable links in each chain, and close them without breaking the jobs.
16 min
You will learn to
- List what root runs from cron and systemd
- Explain PATH hijacking
- Find world-writable directories without the sticky bit
- Check ownership of scripts root executes
- Fix paths and ownership safely
Key terms
- PATH hijacking
- Placing a program with the same name earlier in PATH so it runs instead of the real one.
- Sticky bit
- On a directory: only a file's owner may delete or rename it (/tmp is 1777).
- Execution chain
- Every file and directory on the way from root's job to the code it runs.
- User= (systemd)
- The account a service runs as; without it, a system service runs as root.
- Absolute path
- A full path like /usr/local/sbin/x that doesn't depend on PATH.
← Users, groups, root and sudo · All lessons · Requests, parameters, cookies and sessions →