Skip to content

0070-grub-priv-Ensure Bootloader Configuration Permissions Are Set (-rw-------)

Rule ID

  • 0070-grub-priv

Category

  • system

Level

  • warn

Supported Platforms

  • Linux

Description

  • GRUB is a multi-boot operating system bootloader from the GNU project. GRUB is an implementation of the Multiboot Specification, which allows a user to have multiple operating systems on a computer and choose which one to run when the computer starts. GRUB can be used to select different kernels on the operating system partition, and can also be used to pass boot parameters to these kernels.

Scan Frequency

  • disable

Rationale

  • The GRUB configuration file contains information about boot settings and the password used to unlock boot options. The GRUB2 configuration is typically stored in grub.cfg located in /boot/grub2/.

Risk

  • System can be forcefully accessed by attackers.

Audit Method

  • Run the following command and verify that Uid and Gid are both 0/root, and that Access does not grant group or other permissions:
stat /boot/grub2/grub.cfg Access: (0600/-rw-------)
Uid: ( 0/root)
Gid: ( 0/root)

Remediation

  • Run the following commands to set ownership and permissions on the GRUB configuration:
chown root:root /boot/grub2/grub.cfg
chmod 600 /boot/grub2/grub.cfg

Impact

  • After setting the permissions, only the superuser can read the file.

Default Value

  • By default, the permissions are root:root -rw-------

References

  • None

CIS Controls

  • Version 7

    5.1 Establish Secure Configurations

    Maintain documented, standard security configuration standards for all authorized operating systems and software.

Feedback

Is this page helpful?