1.4.2 Ensure permissions on bootloader config are configured

Information

The grub files contain information on boot settings and passwords for unlocking boot options.

The grub2 configuration is usually grub.cfg On newer grub2 systems the encrypted bootloader password is contained in user.cfg

If the system uses UEFI, /boot/efi is a vfat filesystem. The vfat filesystem itself doesn't have the concept of permissions but can be mounted under Linux with whatever permissions desired.

Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.

Solution

Run the following commands to set ownership and permissions on your grub configuration file(s):

# [ -f /boot/grub2/grub.cfg ] && chown root:root /boot/grub2/grub.cfg
# [ -f /boot/grub2/grub.cfg ] && chmod og-rwx /boot/grub2/grub.cfg

# [ -f /boot/grub2/grubenv ] && chown root:root /boot/grub2/grubenv
# [ -f /boot/grub2/grubenv ] && chmod og-rwx /boot/grub2/grubenv

# [ -f /boot/grub2/user.cfg ] && chown root:root /boot/grub2/user.cfg
# [ -f /boot/grub2/user.cfg ] && chmod og-rwx /boot/grub2/user.cfg

OR If the system uses UEFI, edit /etc/fstab and add the fmask=0077 uid=0 and gid=0 options:

Example:

<device> /boot/efi vfat defaults,umask=0027,fmask=0077,uid=0,gid=0 0 0

Note: This may require a re-boot to enable the change

See Also

https://workbench.cisecurity.org/files/3796