Detections
Analytics

1.3.2 Ensure permissions on bootloader config are configured

Information

The loader.conf file contain information on boot settings and passwords for unlocking boot options.

Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.

Solution

Run the following to update the mode, ownership, and group ownership of the /boot/loader.conf configuration file:

# [ -f /boot/loader.conf ] && chown root:wheel /boot/loader.conf
# [ -f /boot/loader.conf ] && chmod u-x,go-rwx /boot/loader.conf
# [ -e /boot/loader.conf.local ] && chown root:wheel /boot/loader.conf.local
# [ -e /boot/loader.conf.local ] && chmod u-x,go-rwx /boot/loader.conf.local

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 327ac18bc1cf6b44bdc827d462783ae924bd790c56800dd6993aaa13c811d178