Verify /boot/grub2/user.cfg Group Ownership
An XCCDF Rule
Description
The file /boot/grub2/user.cfg should be group-owned by the
root group to prevent reading or modification of the file.
To properly set the group owner of /boot/grub2/user.cfg, run the command:
$ sudo chgrp root /boot/grub2/user.cfg
Rationale
The root group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway. Non-root users who read the boot parameters
may be able to identify weaknesses in security upon boot and be able to exploit them.
- ID
- xccdf_org.ssgproject.content_rule_file_groupowner_efi_user_cfg
- Severity
- Medium
- References
- Updated