Scope & Objectives

Audit containment of long-running services and scheduled jobs on a single Linux host or its config-as-code repository. Determine:

Which services execute with root identity or with identities that are shared, reusable, or login-capable.
Whether systemd units apply the sandboxing directives that cost nothing at design time and remove entire exploit classes (CWE-250: Execution with Unnecessary Privileges).
Whether SELinux or AppArmor is present, and in which mode.
Whether container runtime configuration grants host-equivalent power (docker.sock mounts, --privileged, --network host, --pid host, added capabilities).
Whether root-owned cron/timer scripts can be modified by unprivileged principals.

Constraints for the executing agent:

Run only non-mutating commands: read files, list processes, inspect units, query container metadata. Do not edit unit files, do not restart services, do not enter containers.
Service restarts require orchestrator-approved change windows. Propose them; never perform them during the audit.
This module audits presence, mode, and configuration of containment. Deep SELinux/AppArmor policy authoring and k8s pod security review are specialist follow-ups flagged in Remediation, not performed here.

aegis-service-sandboxing