Ensure permissions on bootloader config are configured

MediumLevel 1Automatedlinux

Description

The grub configuration file contains information on boot settings and passwords for unlocking boot options. The grub configuration is usually located at /boot/grub/menu.lst and linked as /boot/grub/grub.conf .

How it is checked

Audit method: Shell command

shell

alt0() { command -v stat >/dev/null 2>&1 || { echo "step1: stat not installed"; return 1; }; o=$(bash -c 'stat /boot/grub/menu.lst' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)' || { echo step1: missing 'Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)'; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following commands to set permissions on your grub configuration: # chown root:root /boot/grub/menu.lst # chmod og-rwx /boot/grub/menu.lst

Properties

Operating systems: sles-11
Tags: cis-convertedlinux
Reference: CIS SUSE Linux Enterprise 11 Benchmark v2.1.1 - 1.4.1

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux