Verify the UEFI Boot Loader grub.cfg User Ownership
Ensures the UEFI GRUB2 configuration file /boot/efi/EFI/redhat/grub.cfg is owned by the root user (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/boot/efi/EFI/redhat/grub.cfg defines the UEFI boot configuration: kernel command line, boot entries and any GRUB password protection. Only root should be able to modify these boot parameters. If a non-root user owns the file, they could alter the kernel command line (e.g. add init=/bin/bash), disable security mitigations, or strip the bootloader password, defeating boot-time hardening.
What Pavois checks
Pavois stats the live inode of /boot/efi/EFI/redhat/grub.cfg and asserts its owner is UID 0. The check is skipped on systems where the file does not exist (e.g. BIOS/legacy boot). Reading the actual filesystem metadata reflects the effective ownership the firmware and GRUB rely on, regardless of how the file was regenerated by grub2-mkconfig.
only_if { file('/boot/efi/EFI/redhat/grub.cfg').exist? }
describe file('/boot/efi/EFI/redhat/grub.cfg') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /boot/efi/EFI/redhat/grub.cfg. The expected output is root 0.
Inspect & investigate
There is no runtime log for this static config. To detect tampering, set an audit watch: auditctl -w /boot/efi/EFI/redhat/grub.cfg -p wa -k grub, then review events in /var/log/audit/audit.log (grep for key="grub"). Regeneration events appear in journalctl when grub2-mkconfig runs.
Remediation
No automated harden plan is defined for this rule yet, so it must be fixed manually: run chown root /boot/efi/EFI/redhat/grub.cfg to restore root ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /boot/efi/EFI/redhat/grub.cfg |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of grub.cfg can rewrite boot parameters and gain root at next boot or disable kernel mitigations. Fixing it is low-risk: chown root does not change the boot configuration content, so the system still boots normally. Note that grub2-mkconfig recreates the file with root ownership, so the fix is durable; no reboot is needed to apply the ownership change.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R29 | direct | 2.0 | high |
| CIS | 1.4.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.5 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.