1.5.1 Ensure permissions on bootloader config are configured

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


The grub configuration file contains information on boot settings and passwords for unlocking boot options.

The grub configuration is usually grub.cfg and grubenv stored in /boot/grub2/'


Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.


Run the following commands to set ownership and permissions on your grub configuration file(s):

# chown root:root /boot/grub2/grub.cfg
# test -f /boot/grub2/user.cfg && chown root:root /boot/grub2/user.cfg
# chmod og-rwx /boot/grub2/grub.cfg
# test -f /boot/grub2/user.cfg && chmod og-rwx /boot/grub2/user.cfg

OR If the system uses UEFI, edit /etc/fstab and add the fmask=0077 option:

<device> /boot/efi vfat defaults,umask=0027,fmask=0077,uid=0,gid=0 0 0

Note: This may require a re-boot to enable the change

Additional Information:

This recommendation is designed around the grub bootloader, if LILO or another bootloader is in use in your environment enact equivalent settings.

Replace /boot/grub2/grub.cfg and /boot/grub2/grubenv with the appropriate configuration file(s) for your environment

See Also