Verify /boot/grub2/user.cfg Group Ownership
Ensures /boot/grub2/user.cfg (the GRUB superuser password file) is group-owned by root (GID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/boot/grub2/user.cfg stores the GRUB bootloader superuser password (as a PBKDF2 hash). That password gates editing boot entries and reaching single-user mode. If a non-root group owns the file, members could read the hash for offline cracking or tamper with it. Setting the group to root (GID 0) ensures only the most privileged group can access the bootloader credential.
What Pavois checks
Pavois reads the resolved numeric GID of /boot/grub2/user.cfg via the InSpec file resource and asserts it equals 0. It checks the live inode metadata at audit time, so the result reflects the file's actual ownership rather than a documented default.
only_if { file('/boot/grub/user.cfg').exist? }
describe file('/boot/grub/user.cfg') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%g %G' /boot/grub2/user.cfg. The expected output is:
0 root
List it with ls -l /boot/grub2/user.cfg to confirm the group column shows root.
Inspect & investigate
GRUB credential file changes are not logged by default. To trace them, add an auditd watch (auditctl -w /boot/grub2/user.cfg -p wa -k grub_cfg) and grep /var/log/audit/audit.log for key="grub_cfg".
Remediation
This rule has no automated harden plan in Pavois. Apply it manually by setting the group to root: chgrp root /boot/grub2/user.cfg (or chown :root /boot/grub2/user.cfg).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /boot/grub/user.cfg |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If a non-root group owns this file, the GRUB superuser hash can leak, enabling offline cracking and physical-access boot tampering. Correcting group ownership has no runtime effect, it does not change the password or boot flow. Precaution: this is a RHEL-family path (BIOS GRUB2); on UEFI the file may live under /boot/efi/EFI/<distro>/user.cfg. Verify the real path before acting, and do not delete or empty the file or you may disable the bootloader password protection entirely.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R29 | direct | 2.0 | high |
| CIS | 2.2.6, 1.4.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.5, AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.