1.5.2 Ensure permissions on bootloader config are configured - /boot/grub2/user.cfg

Information

The grub configuration file contains information on boot settings and passwords for unlocking boot options. The grub2 configuration is usually grub.cfg stored in /boot/grub2/. On newer grub2 systems the encrypted bootloader password is contained in /boot/grub2/user.cfg.

Notes:

This recommendation is designed around the grub2 bootloader.

If LILO or another bootloader is in use in your environment:

Enact equivalent settings

Replace /boot/grub2/grub.cfg and /boot/grub2/user.cfg with the appropriate boot configuration files for your environment

Rationale:

Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.

Solution

Run the following commands to set ownership and permissions on your grub configuration:

# chown root:root /boot/grub2/grub.cfg
# test -f /boot/grub2/user.cfg && chown root:root /boot/grub2/user.cfg
# chmod og-rwx /boot/grub2/grub.cfg
# test -f /boot/grub2/user.cfg && chmod og-rwx /boot/grub2/user.cfg

See Also

https://workbench.cisecurity.org/files/2925

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5.1

Plugin: Unix

Control ID: 1300390e8c51de4204cccdff7fd210ef44ee4faea809dac729910d5454edc938