Detections
Analytics

1.4.2 Ensure access to bootloader config is configured

Information

The grub files contain information on boot settings and passwords for unlocking boot options.

Setting the permissions to read and write for root only prevents non-root users from seeing the boot parameters or changing them. Non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.

Solution

Run the following to update the mode, ownership, and group ownership of the grub configuration files:

- IF - Files are located in /boot/efi/EFI/* Note: This is a vFat filesystem

Edit /etc/fstab and add the fmask=0077, uid=0, and gid=0 options:

Example:

<device> /boot/efi vfat defaults,umask=0027,fmask=0077,uid=0,gid=0 0 0

Note: This may require a re-boot to enable the change

- OR -

- IF - Files are located in /boot/grub2/* :

Run the following commands to set ownership and permissions on your grub configuration file(s):

# [ -f /boot/grub2/grub.cfg ] && chown root:root /boot/grub2/grub.cfg
# [ -f /boot/grub2/grub.cfg ] && chmod u-x,go-rwx /boot/grub2/grub.cfg

# [ -f /boot/grub2/grubenv ] && chown root:root /boot/grub2/grubenv
# [ -f /boot/grub2/grubenv ] && chmod u-x,go-rwx /boot/grub2/grubenv

# [ -f /boot/grub2/user.cfg ] && chown root:root /boot/grub2/user.cfg
# [ -f /boot/grub2/user.cfg ] && chmod u-x,go-rwx /boot/grub2/user.cfg

Impact:

Restricting access to the bootloader configuration files has no impact on normal system operation. Note that permissions on the /boot/efi vFat filesystem are governed by filesystem mount options ( fmask, uid, gid in /etc/fstab ) rather than chmod, so applying them there requires an /etc/fstab change and may require a reboot to take effect.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-6b., 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: d4048e86846e2b81a00471cfeaa5d301a51a7604dac16e9ab2e09cb0f422b2ae