Verify /boot/grub2/grub.cfg Group Ownership
Ensures the GRUB2 boot configuration /boot/grub2/grub.cfg is owned by group root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/boot/grub2/grub.cfg defines the boot menu, kernel command-line and the GRUB password that protects single-user/recovery boot. The root group is highly privileged, and the group-owner of this file should hold no access anyway. If a non-root group owns it, an attacker could be granted write access and add kernel parameters (e.g. init=/bin/bash) or strip the boot password, gaining offline, pre-OS control of the machine. Group ownership by root (gid 0) is the baseline protection.
What Pavois checks
Pavois reads the real group id of /boot/grub2/grub.cfg via InSpec's file resource and asserts gid == 0. It checks the effective ownership on disk, a key point because grub2-mkconfig regenerates this file on each kernel update, and Pavois catches a regeneration that left a wrong group, which a one-time deployment audit would miss.
only_if { file('/boot/grub/grub.cfg').exist? }
describe file('/boot/grub/grub.cfg') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /boot/grub2/grub.cfg. Expected output: root 0. (On UEFI systems the active file may be under /boot/efi/EFI/<distro>/grub.cfg.)
Inspect & investigate
Add an auditd watch, auditctl -w /boot/grub2/grub.cfg -p wa -k grub, and changes appear in /var/log/audit/audit.log (grep 'key="grub"' /var/log/audit/audit.log). GRUB regeneration during package updates is logged in /var/log/dnf.log / journalctl.
Remediation
No automated remediation is wired for this rule, so it must be applied manually: chgrp 0 /boot/grub2/grub.cfg. Re-run pavois harden verify afterwards.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /boot/grub/grub.cfg |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root group on grub.cfg risks pre-boot tampering and bypass of the GRUB password. Resetting the group to root is safe, only the bootloader and root read this file at boot. Precaution: keep the mode at 0600 so the boot password hash stays unreadable; remember that a future grub2-mkconfig may rewrite the file, so re-verify after kernel updates.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R29 | direct | 2.0 | high |
| CIS | 2.2.6, 1.4.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.5, AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.