An XCCDF Group - A logical subset of the XCCDF Benchmark
/boot/grub/grub.cfg
root
$ sudo chown root /boot/grub/grub.cfg
$ sudo chmod 600 /boot/grub/grub.cfg
# grub2-mkpasswd-pbkdf2
/etc/grub.d/40_custom
set superusers="boot" password_pbkdf2 boot grub.pbkdf2.sha512.VeryLongString
grub.cfg
update-grub