All GRUB configuration files must be group-owned by root
Ensures /boot/grub2 (the GRUB bootloader configuration directory) is group-owned by root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/boot/grub2 holds the bootloader configuration (grub.cfg, the boot password hash, kernel command line). If its group owner is not root (gid 0), an unprivileged group could read the GRUB password hash for offline cracking, or modify boot parameters (e.g. add init=/bin/bash or disable security options), gaining control of the system at the earliest boot stage, before most defenses load.
What Pavois checks
Pavois reads the effective ownership of /boot/grub2 from the inode (via stat) and asserts gid == 0. Checking the live inode catches ownership drift from package updates (grub2-mkconfig) or manual edits rather than trusting a template. The only_if guard skips the check when the path is absent (e.g. EFI-only layouts use /boot/efi).
only_if { file('/boot/grub2').exist? }
describe file('/boot/grub2') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /boot/grub2. Expected output: root 0. To check recursively: find /boot/grub2 ! -group root. If the path does not exist the control is skipped.
Inspect & investigate
Ownership changes are not logged by default. Inspect with ls -ld /boot/grub2 or stat /boot/grub2. With an auditd watch (auditctl -w /boot/grub2 -p wa), chown events appear in /var/log/audit/audit.log. GRUB regeneration is logged via journalctl when run through grub2-mkconfig.
Remediation
No automated harden plan is defined for this rule yet, so it must be applied manually: run chgrp -R root /boot/grub2 (or chown -R :root /boot/grub2) to restore root group ownership across the GRUB configuration.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /boot/grub2 |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A wrong group owner on /boot/grub2 can expose the GRUB password hash and let an unprivileged group alter boot parameters, enabling pre-boot system takeover. Precautions: restoring root group ownership is safe and does not affect booting, GRUB reads these files as root at boot time. Avoid loosening permissions to share boot logs; if grub2-mkconfig later rewrites files, re-verify ownership.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.4.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.