Ensure permissions on bootloader config are configured

MediumLevel 1Automatedlinux

Description

The grub configuration file contains information on boot settings and passwords for unlocking boot options. The grub configuration is usually located at /boot/grub2/grub.cfg and linked as /etc/grub2.cfg. Additional settings can be found in the /boot/grub2/user.cfg file.

How it is checked

Audit method: Shell command

shell

alt0() { command -v stat >/dev/null 2>&1 || { echo "step1: stat not installed"; return 1; }; o=$(bash -c 'stat /boot/grub2/grub.cfg' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following commands to set permissions on your grub configuration: # chown root:root /boot/grub2/grub.cfg # chmod 600 /boot/grub2/grub.cfg

Properties

Operating systems: alinux-2
Tags: cis-convertedlinux
Reference: CIS Aliyun Linux 2 Benchmark v1.0.0 ARCHIVE - 1.4.1

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux