Verify Group Who Owns System.map Files
Ensures the /boot directory (holding the kernel and System.map symbol tables) is group-owned by root.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /boot directory contains the kernel, initramfs and System.map symbol tables used for kernel debugging and profiling. The symbol map exposes kernel memory addresses that help an attacker defeat protections like KASLR and craft precise exploits. Restricting /boot to the root group keeps these boot-time and kernel internals away from ordinary users.
What Pavois checks
Pavois reads the resolved group ownership of /boot via the InSpec file resource and asserts the group is root. It inspects the live inode metadata, so the result reflects how the partition is actually mounted and owned, not a defaults table.
describe command("find /boot -maxdepth 1 -name 'System.map-*' ! -group root 2>/dev/null") do
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run stat -c '%G' /boot. The expected output is:
root
List it with ls -ld /boot and check System.map* files with ls -l /boot/System.map*.
Inspect & investigate
Boot-related file changes are not logged by default. To trace edits, add an auditd watch (auditctl -w /boot -p wa -k boot_perms) and grep /var/log/audit/audit.log for key="boot_perms". The mount itself is visible with findmnt /boot.
Remediation
Pavois's harden plan applies the file resource to set the group of /boot to root. It is applied with pavois harden apply and leaves the owner and permission bits untouched.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | find /boot -maxdepth 1 -name 'System.map-*' -exec chgrp root {} + 2>/dev/null; true |
|---|---|
| name | systemmap-group |
| not_if | test -z "$(find /boot -maxdepth 1 -name 'System.map-*' ! -group root 2>/dev/null)" |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If /boot is group-owned by a non-root group, unprivileged users may read kernel symbol maps and boot parameters, easing exploit development. The fix only adjusts group ownership and does not affect booting. Precaution: if /boot is a mounted partition, ensure the mount's default ownership does not revert the change on remount; for EFI setups the /boot/efi (vfat) mount may not support Unix groups, which is expected and out of scope for this directory check.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R29 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.