highsystemverified ✓rollback-safe

Set GRUB configuration file permissions

grub-config-permissions · RHEL ≥ 8 · 1 impl

Description

The GRUB configuration file /boot/grub2/grub.cfg should have restrictive permissions to prevent unauthorized modification.

Rationale

If the GRUB configuration can be modified by unauthorized users, they could alter boot parameters to gain elevated privileges or disable security features.

Check → Remediate

Checkfile_permission

path:: /boot/grub2/grub.cfg
mode:: 0600
owner:: root
group:: root

Remediatefile_permissions

path:: /boot/grub2/grub.cfg
mode:: 0600
owner:: root
group:: root

Framework references

CIS

rhel8 1.4.2rhel9 1.4.2rhel10 1.4.2

STIG

V-257790V-257791V-281086 / RHEL-10-400345V-281087

NIST 800-53

AC-3AC-6

Live verification

rhel10:checkrhel8:checkrhel9:check

#grub#bootloader#permissions#physical-security