Ensure access to bootloader config is configured

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_output=() a_output2=()
   file_access_chk()
   {
      a_out=() a_out2=()
      [[ "$(dirname "$l_file")" =~ ^\/boot\/efi\/EFI ]] && l_pmask="0077" || l_pmask="0177"
      l_maxperm="$( printf '"'"'%o'"'"' $(( 0777 & ~$l_pmask )) )"
      if [ $(( $l_mode & $l_pmask )) -gt 0 ]; then
         a_out2+=("   - Is mode \"$l_mode\" and should be mode: \"$l_maxperm\" or more restrictive")
      else
         a_out+=("   - Is correctly mode: \"$l_mode\" which is mode: \"$l_maxperm\" or more restrictive")
      fi
      if [ "$l_user" = "root" ]; then
         a_out+=("   - Is correctly owned by user: \"$l_user\"")
      else
         a_out2+=("   - Is owned by user: \"$l_user\" and should be owned by user: \"root\"")
      fi
      if [ "$l_group" = "root" ]; then
         a_out+=("   - Is correctly group-owned by group: \"$l_user\"")
      else
         a_out2+=("   - Is group-owned by group: \"$l_user\" and should be group-owned by group: \"root\"")
      fi
      [ "${#a_out[@]}" -gt 0 ] && a_output+=("  - File: \"$l_file\"" "${a_out[@]}" "")
      [ "${#a_out2[@]}" -gt 0 ] && a_output2+=("  - File: \"$l_file\"" "${a_out2[@]}" "")
   }
   while IFS= read -r -d $'"'"'\0'"'"' l_gfile; do
      while IFS=: read -r l_file l_mode l_user l_group; do
         file_access_chk
      done <<< "$(stat -Lc '"'"'%n:%#a:%U:%G'"'"' "$l_gfile")"
   done < <(find /boot -type f \( -name '"'"'grub*'"'"' -o -name '"'"'user.cfg'"'"' \) - print0)
   if [ "${#a_output2[@]}" -le 0 ]; then
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** PASS **" "${a_output[@]}" ""
   else
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** FAIL **" " - Reason(s) for audit failure:" "${a_output2[@]}"
      [ "${#a_output[@]}" -gt 0 ] && printf '"'"'%s\n'"'"' "" "- Correctly set:" "${a_output[@]}" ""
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi

tmaegis scan --target linux