Built-in periodic host security self-scan (rootkit / LD_PRELOAD / miner IOC class)

[MagnaCapax]

Problem

PMSS ships no periodic host-integrity / rootkit self-scan. A host-level compromise — a userland LD_PRELOAD rootkit, unauthorised persistence, a cryptominer — can persist undetected for a long time because nothing on the host looks for it on a schedule. PMSS already runs periodic self-checks for storage (storageHealth.php) and MD arrays (mdadmCheckarray.php via root.cron); the security/integrity class has no equivalent.

Scope of THIS issue (one task)

A new /scripts/cron/ host security self-scan script, wired into etc/seedbox/config/root.cron with the SAME hostname-hash stagger as the existing mdadm checkarray cron (weekly, spread 0–5h so the fleet never scans in lockstep). Logs to /var/log/pmss/, writes a status file, exits non-zero on a hit.

v1 checks — cheap, deterministic, generalised to the CLASS (not tied to any single sample's artifacts)

• /etc/ld.so.preload non-empty
• any process with LD_PRELOAD in its environ pointing outside standard library paths
• any process whose /proc/<pid>/exe resolves into a directory that should hold no executables (/var/lib/systemd, /tmp, /dev/shm, and similar)
• sshd effective config (sshd -T) carrying AuthorizedKeysCommand / AuthorizedKeysFile / SetEnv — unexpected on a stock host
• live-process cmdline carrying miner / stratum / pool signatures

Class-level checks (rootkit / preload / persistence / miner) — catch the shape, not last week's hash.

Reporting discipline

A clean scan is silent (log + exit, nothing more). Only a hit surfaces. No routine-success notification — that discipline is what keeps this from becoming alert-fatigue.

Definition of done

• script implemented + unit-tested against a known-bad fixture and a clean fixture
• root.cron wired with hostname-hash stagger
• ADR written (per AGENTS.md) — this runs on every seedbox host, a fleet-wide behaviour change
• ships via the normal update mechanism

Explicitly out of scope (separate issues if pursued)

• apt-health / broken-package-manager canary (generic maintenance, different cadence) — its own issue
• optional rkhunter / chkrootkit layer-2 — evaluate separately; both are noisy (rkhunter needs --propupd after every update or it false-positives), so they are NOT assumed for v1

---

_{Tier-3 declared at filing: --why needs-fleet-coordination — GH#631 tier gate. Declared fix size: 150 lines vs 33-line body — size gate (operator directive 2026-07-29). Owner: etc/seedbox/config/root.cron in MagnaCapax/PMSS — owner gate.}