You are not logged in.
- Topics: Active | Unanswered
#1 2019-08-10 07:24:52
- Xwang
- Member
- From: EU
- Registered: 2012-05-14
- Posts: 419
Is this systemctl list-unit-files output correct?
Is this systemctl list-unit-files output correct? is there a way to check if there is any strange service? Is it possible to know which executable(s) are run by each service with a command or a script (in order to avoid to repeat it 343 times)? Is there a way to check the coherence of those executables/services with repo packages? How to find if there is any malicious service?
systemctl list-unit-files
UNIT FILE STATE
proc-sys-fs-binfmt_misc.automount static
-.mount generated
boot.mount generated
data.mount generated
dev-hugepages.mount static
dev-mqueue.mount static
proc-sys-fs-binfmt_misc.mount static
sys-fs-fuse-connections.mount static
sys-kernel-config.mount static
sys-kernel-debug.mount static
tmp.mount static
var-lib-machines.mount static
org.cups.cupsd.path enabled
systemd-ask-password-console.path static
systemd-ask-password-wall.path static
session-2.scope transient
accounts-daemon.service disabled
alsa-restore.service static
alsa-state.service static
apparmor.service disabled
auditd.service disabled
autovt@.service enabled
avahi-daemon.service enabled
avahi-dnsconfd.service disabled
blk-availability.service disabled
bluetooth.service enabled
btrfs-scrub@.service static
canberra-system-bootup.service disabled
canberra-system-shutdown-reboot.service disabled
canberra-system-shutdown.service disabled
clamav-daemon.service disabled
clamav-freshclam.service enabled
clean-mount-point@.service static
colord.service static
configure-printer@.service static
console-getty.service disabled
container-getty@.service static
cronie.service enabled
cups-browsed.service disabled
dbus-org.bluez.service enabled
dbus-org.freedesktop.Avahi.service enabled
dbus-org.freedesktop.hostname1.service static
dbus-org.freedesktop.import1.service static
dbus-org.freedesktop.locale1.service static
dbus-org.freedesktop.login1.service static
dbus-org.freedesktop.machine1.service static
dbus-org.freedesktop.NetworkManager.service enabled
dbus-org.freedesktop.nm-dispatcher.service enabled
dbus-org.freedesktop.portable1.service static
dbus-org.freedesktop.timedate1.service static
dbus.service static
debug-shell.service disabled
dhcpcd.service disabled
dhcpcd@.service disabled
disable-USB-wakeup.service enabled
display-manager.service enabled
dm-event.service static
dmraid.service disabled
e2scrub@.service static
e2scrub_all.service static
e2scrub_fail@.service static
e2scrub_reap.service disabled
ead.service disabled
emergency.service static
fancontrol.service disabled
fstrim.service static
ftpd.service disabled
geoclue.service static
getty@.service enabled
git-daemon@.service static
gpm.service disabled
healthd.service disabled
initrd-cleanup.service static
initrd-parse-etc.service static
initrd-switch-root.service static
initrd-udevadm-cleanup-db.service static
ip6tables.service disabled
iptables.service disabled
irexec.service disabled
iwd.service disabled
kmod-static-nodes.service static
krb5-kadmind.service disabled
krb5-kdc.service disabled
krb5-kpropd.service disabled
krb5-kpropd@.service static
ldconfig.service static
lircd-setup.service disabled
lircd-uinput.service disabled
lircd.service disabled
lircmd.service disabled
lm_sensors.service disabled
logrotate.service static
lvm2-lvmetad.service static
lvm2-lvmpolld.service static
lvm2-monitor.service static
lvm2-pvscan@.service static
man-db.service static
mariadb.service disabled
mariadb@.service disabled
mdadm-grow-continue@.service static
mdadm-last-resort@.service static
mdmon@.service static
mdmonitor.service static
mkinitcpio-generate-shutdown-ramfs.service static
ModemManager.service disabled
mysqld.service disabled
mysqld@.service disabled
ndctl-monitor.service disabled
netctl-auto@.service disabled
netctl-ifplugd@.service disabled
netctl-sleep.service disabled
netctl-wait-online.service disabled
netctl.service disabled
netctl@.service static
NetworkManager-dispatcher.service enabled
NetworkManager-wait-online.service enabled
NetworkManager.service enabled
nscd.service disabled
nvidia-hibernate.service disabled
nvidia-persistenced.service disabled
nvidia-resume.service disabled
nvidia-suspend.service disabled
org.cups.cups-lpd@.service static
org.cups.cupsd.service enabled
paccache.service static
pamac-cleancache.service static
pamac-system.service static
pkgfile-update.service static
polkit.service static
ppp@.service disabled
quotaon.service static
rescue.service static
rfkill-block@.service disabled
rfkill-unblock@.service disabled
rlogin@.service static
rpcbind.service disabled
rsh@.service static
rsyncd.service disabled
rsyncd@.service static
rtkit-daemon.service disabled
saned@.service static
sddm.service enabled
sensord.service disabled
serial-getty@.service disabled
shadow.service static
smartd.service disabled
snmpd.service disabled
snmptrapd.service disabled
sshd.service disabled
sshd@.service static
sshdgenkeys.service static
svnserve.service disabled
system-update-cleanup.service static
systemd-ask-password-console.service static
systemd-ask-password-wall.service static
systemd-backlight@.service static
systemd-binfmt.service static
systemd-bless-boot.service static
systemd-boot-check-no-failures.service disabled
systemd-coredump@.service static
systemd-exit.service static
systemd-firstboot.service static
systemd-fsck-root.service enabled-runtime
systemd-fsck@.service static
systemd-halt.service static
systemd-hibernate-resume@.service static
systemd-hibernate.service static
systemd-hostnamed.service static
systemd-hwdb-update.service static
systemd-hybrid-sleep.service static
systemd-importd.service static
systemd-initctl.service static
systemd-journal-catalog-update.service static
systemd-journal-flush.service static
systemd-journal-gatewayd.service indirect
systemd-journal-remote.service indirect
systemd-journal-upload.service disabled
systemd-journald.service static
systemd-kexec.service static
systemd-localed.service static
systemd-logind.service static
systemd-machine-id-commit.service static
systemd-machined.service static
systemd-modules-load.service static
systemd-networkd-wait-online.service disabled
systemd-networkd.service disabled
systemd-nspawn@.service disabled
systemd-portabled.service static
systemd-poweroff.service static
systemd-quotacheck.service static
systemd-random-seed.service static
systemd-reboot.service static
systemd-remount-fs.service enabled-runtime
systemd-resolved.service disabled
systemd-rfkill.service static
systemd-suspend-then-hibernate.service static
systemd-suspend.service static
systemd-sysctl.service static
systemd-sysusers.service static
systemd-time-wait-sync.service disabled
systemd-timedated.service static
systemd-timesyncd.service enabled
systemd-tmpfiles-clean.service static
systemd-tmpfiles-setup-dev.service static
systemd-tmpfiles-setup.service static
systemd-udev-settle.service static
systemd-udev-trigger.service static
systemd-udevd.service static
systemd-update-done.service static
systemd-update-utmp.service static
systemd-user-sessions.service static
systemd-vconsole-setup.service static
systemd-volatile-root.service static
talk.service indirect
teamd@.service static
telnet@.service static
udisks2.service disabled
updatedb.service static
upower.service disabled
usbmuxd.service static
user-runtime-dir@.service static
user@.service static
uuidd.service indirect
vboxweb.service disabled
wpa_supplicant-nl80211@.service disabled
wpa_supplicant-wired@.service disabled
wpa_supplicant.service disabled
wpa_supplicant@.service disabled
xfs_scrub@.service static
xfs_scrub_all.service static
xfs_scrub_fail@.service static
zram-setup@.service static
machine.slice static
user.slice static
avahi-daemon.socket enabled
clamav-daemon.socket disabled
dbus.socket static
dm-event.socket static
git-daemon.socket disabled
krb5-kpropd.socket disabled
lircd.socket disabled
lvm2-lvmetad.socket static
lvm2-lvmpolld.socket static
org.cups.cups-lpd.socket disabled
org.cups.cupsd.socket enabled
rlogin.socket disabled
rpcbind.socket disabled
rsh.socket disabled
rsyncd.socket disabled
saned.socket disabled
sshd.socket disabled
syslog.socket static
systemd-coredump.socket static
systemd-initctl.socket static
systemd-journal-gatewayd.socket disabled
systemd-journal-remote.socket disabled
systemd-journald-audit.socket static
systemd-journald-dev-log.socket static
systemd-journald.socket static
systemd-networkd.socket disabled
systemd-rfkill.socket static
systemd-udevd-control.socket static
systemd-udevd-kernel.socket static
talk.socket disabled
telnet.socket disabled
uuidd.socket disabled
basic.target static
bluetooth.target static
boot-complete.target static
cryptsetup-pre.target static
cryptsetup.target static
ctrl-alt-del.target disabled
default.target static
emergency.target static
exit.target disabled
final.target static
getty-pre.target static
getty.target static
graphical.target static
halt.target disabled
hibernate.target static
hybrid-sleep.target static
initrd-fs.target static
initrd-root-device.target static
initrd-root-fs.target static
initrd-switch-root.target static
initrd.target static
kexec.target disabled
local-fs-pre.target static
local-fs.target static
machines.target disabled
multi-user.target static
network-online.target static
network-pre.target static
network.target static
nss-lookup.target static
nss-user-lookup.target static
paths.target static
poweroff.target disabled
printer.target static
reboot.target disabled
remote-cryptsetup.target disabled
remote-fs-pre.target static
remote-fs.target enabled
rescue.target static
rpcbind.target static
runlevel0.target disabled
runlevel1.target static
runlevel2.target static
runlevel3.target static
runlevel4.target static
runlevel5.target static
runlevel6.target disabled
shutdown.target static
sigpwr.target static
sleep.target static
slices.target static
smartcard.target static
sockets.target static
sound.target static
suspend-then-hibernate.target static
suspend.target static
swap.target static
sysinit.target static
system-update-pre.target static
system-update.target static
time-set.target static
time-sync.target static
timers.target static
umount.target static
btrfs-scrub@.timer disabled
e2scrub_all.timer disabled
fstrim.timer enabled
logrotate.timer disabled
man-db.timer disabled
mdadm-last-resort@.timer static
paccache.timer disabled
pamac-cleancache.timer enabled
pkgfile-update.timer disabled
shadow.timer static
systemd-tmpfiles-clean.timer static
updatedb.timer static
xfs_scrub_all.timer disabledLast edited by Xwang (2019-08-10 08:04:51)
Offline
#2 2019-08-10 07:34:58
- Grant
- Member
- From: Italy
- Registered: 2012-12-15
- Posts: 246
Re: Is this systemctl list-unit-files output correct?
If there were a malicious service, which would thus have gained root privileges to be there, you'd have much worse issues than that.
Is this systemctl list-unit-files output correct? Is there any strange service?
You don't want to go through them so should we? :/
Last edited by Grant (2019-08-10 07:35:45)
Offline
#3 2019-08-10 07:40:58
- Xwang
- Member
- From: EU
- Registered: 2012-05-14
- Posts: 419
Re: Is this systemctl list-unit-files output correct?
If there were a malicious service, which would thus have gained root privileges to be there, you'd have much worse issues than that.
Xwang wrote:Is this systemctl list-unit-files output correct? Is there any strange service?
You don't want to go through them so should we?
Sorry I meant "is there a way to check if there is any strange service?"
Offline
#4 2019-08-10 07:59:26
- jasonwryan
- Anarchist
- From: .nz
- Registered: 2009-05-09
- Posts: 30,426
- Website
Re: Is this systemctl list-unit-files output correct?
Please edit your post and use code tags: https://wiki.archlinux.org/index.php/Co … s_and_code
Offline
#5 2019-08-10 11:04:40
- loqs
- Member
- Registered: 2014-03-06
- Posts: 19,101
Re: Is this systemctl list-unit-files output correct?
Have you identified any service files not tracked by pacman? [1] That are not produced by generators?
Offline
#6 2019-08-10 12:49:31
- Trilby
- Inspector Parrot
- Registered: 2011-11-29
- Posts: 30,530
- Website
Re: Is this systemctl list-unit-files output correct?
Recurring theme: please operationally define what you are actually looking for:
Is this systemctl list-unit-files output correct?
As in does it represent all the service files in memory? Yes, by definition, unless there is a bug in systemd - but simply looking at that output could never reveal such a bug.
Does it tell you anything useful? Probably not. I don't know what you suspect may be found from looking at that list.
is there a way to check if there is any strange service?
Strange?
"Services are strange when you're a stranger
Programs look ugly when you're alone"
Is it possible to know which executable(s) are run by each service with a command or a script (in order to avoid to repeat it 343 times)?
For every single one of them? Wouldn't you be more interested in the ones with executables that are actually running? If so, just us `ps`. You can see executables launched by all service files on your computer with something like the following:
find /usr/lib/systemd/ -name *.service -exec sed -n 's/^Exec[A-Za-z]*=-*//p' '{}' \+But of course this will not work for generated units.
Is there a way to check the coherence of those executables/services with repo packages?
Coherence? That's even more strange than "strange". But if you have such suspicions, you'd be better of checking for unwanted binaries on your system independent of whether or not they have service files. `pacman -Qkk` and checking your root filesystem for files not tracked by pacman would be good for this - but again, that has nothing to do with this list of service files.
This sounds a bit like an X-Y question. Are you trying to track something down? If so, what? Are you suspicious that you might have some malicious software running? If so, why?
Last edited by Trilby (2019-08-10 12:51:16)
"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman
Offline
#7 2019-08-11 07:05:11
- Xwang
- Member
- From: EU
- Registered: 2012-05-14
- Posts: 419
Re: Is this systemctl list-unit-files output correct?
Have you identified any service files not tracked by pacman? [1] That are not produced by generators?
No, but I'll do asap. Thank you!
Offline
#8 2019-08-11 07:15:13
- Xwang
- Member
- From: EU
- Registered: 2012-05-14
- Posts: 419
Re: Is this systemctl list-unit-files output correct?
Recurring theme: please operationally define what you are actually looking for:
Xwang wrote:Is this systemctl list-unit-files output correct?
As in does it represent all the service files in memory? Yes, by definition, unless there is a bug in systemd - but simply looking at that output could never reveal such a bug.
Does it tell you anything useful? Probably not. I don't know what you suspect may be found from looking at that list.
Xwang wrote:is there a way to check if there is any strange service?
Strange?
"Services are strange when you're a stranger
Programs look ugly when you're alone"Xwang wrote:Is it possible to know which executable(s) are run by each service with a command or a script (in order to avoid to repeat it 343 times)?
For every single one of them? Wouldn't you be more interested in the ones with executables that are actually running? If so, just us `ps`. You can see executables launched by all service files on your computer with something like the following:
find /usr/lib/systemd/ -name *.service -exec sed -n 's/^Exec[A-Za-z]*=-*//p' '{}' \+But of course this will not work for generated units.
Xwang wrote:Is there a way to check the coherence of those executables/services with repo packages?
Coherence? That's even more strange than "strange". But if you have such suspicions, you'd be better of checking for unwanted binaries on your system independent of whether or not they have service files. `pacman -Qkk` and checking your root filesystem for files not tracked by pacman would be good for this - but again, that has nothing to do with this list of service files.
This sounds a bit like an X-Y question. Are you trying to track something down? If so, what? Are you suspicious that you might have some malicious software running? If so, why?
I'm trying to check if in the last 3 or 4 years since I've installed archlinux on this pc some malicus software has been installed on the pc (maybe via an AUR package that I've not checked well).
I can check the files which are running via ps, but I think (maybe wrongly) that if the malicius software (if any) runs for some seconds and then stops, it can be not noted via ps.
Instead to run it should have a service or a cronjob. I am right? Are there other ways a malicius software can use to "autorun"?
your suggestion to check for unwanted binaries using pacman -Qkk in which way differs from loqs' one to use pacreport --unowned-files? In any case I'm going to check both.
It is just to be sure that the system is clean.
Offline
#9 2019-08-11 12:49:48
- Trilby
- Inspector Parrot
- Registered: 2011-11-29
- Posts: 30,530
- Website
Re: Is this systemctl list-unit-files output correct?
your suggestion to check for unwanted binaries using pacman -Qkk
Nope - I didn't suggest that. Checking for untracked binaries and checking `pacman -Qkk` are two entirely seperate things.
"UNIX is simple and coherent" - Dennis Ritchie; "GNU's Not Unix" - Richard Stallman
Offline