All GRUB configuration files must be owned by root
Ensures the GRUB2 configuration directory /boot/grub2 is owned by the root user (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /boot/grub2 directory holds the bootloader configuration (grub.cfg) that controls how the system boots, including kernel command-line parameters. If it is not owned by root, an unprivileged user could alter boot options, for example adding init=/bin/bash or disabling security mitigations, to gain control of the system at boot or bypass hardening. Owning boot configuration by root is foundational to a trustworthy boot chain.
What Pavois checks
Pavois reads the effective owner of /boot/grub2 via the InSpec file resource and asserts uid == 0, only when the path exists (only_if). Inspecting the live inode ownership reflects the real on-disk state, including drift caused by grub2-mkconfig runs or manual edits, rather than a packaging default that may have been overridden.
only_if { file('/boot/grub2').exist? }
describe file('/boot/grub2') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /boot/grub2. Expected output: root 0. Alternatively ls -ld /boot/grub2 should show root in the owner column.
Inspect & investigate
Ownership has no service log. Confirm the state with stat -c '%U %u' /boot/grub2. To trace changes, an auditd watch such as auditctl -w /boot/grub2 -p wa -k grub-cfg records writes/attribute changes in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: run chown root /boot/grub2 (add -R to cover the contents) as root to set the owner to root.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /boot/grub2 |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If misconfigured, a non-root user could rewrite GRUB options and seize control of the boot process or bypass security settings.
Precautions before applying: chown root /boot/grub2 is safe and reversible. On UEFI systems the active config may instead live under /boot/efi/EFI/<distro>/grub.cfg; verify the real path before assuming. Do not change ownership to a non-existent user, and avoid combining with overly strict permissions that could prevent grub2-mkconfig from regenerating the file.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.4.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.