Verify /boot/efi/EFI/redhat/user.cfg User Ownership
Ensures the GRUB password file /boot/efi/EFI/redhat/user.cfg is owned by the root user (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/boot/efi/EFI/redhat/user.cfg stores the GRUB bootloader password hash (GRUB2_PASSWORD). Only root should be able to modify these boot parameters. If a non-root user owns the file they could remove or replace the password and bypass boot protection; even read access lets an attacker harvest the hash for offline cracking, or spot security weaknesses to exploit at boot.
What Pavois checks
Pavois stats the live inode of /boot/efi/EFI/redhat/user.cfg and asserts its owner is UID 0. The check is skipped when the file is absent (no GRUB password configured). Reading the actual filesystem metadata reflects the effective ownership in force, not a templated default.
only_if { file('/boot/efi/EFI/redhat/user.cfg').exist? }
describe file('/boot/efi/EFI/redhat/user.cfg') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /boot/efi/EFI/redhat/user.cfg. The expected output is root 0.
Inspect & investigate
There is no runtime log for this static file. To detect tampering, set an audit watch: auditctl -w /boot/efi/EFI/redhat/user.cfg -p wa -k grub, then review events in /var/log/audit/audit.log (grep for key="grub").
Remediation
No automated harden plan is defined for this rule yet, so it must be fixed manually: run chown root /boot/efi/EFI/redhat/user.cfg to restore root ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /boot/efi/EFI/redhat/user.cfg |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of user.cfg can strip or replace the GRUB password, defeating the boot-time access control, and can read the password hash for offline attack. Fixing it is low-risk: chown root does not alter the password hash, so existing boot protection keeps working. Pair this with restrictive permissions (chmod 600) so the hash is not world-readable.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R29 | direct | 2.0 | high |
| CIS | 1.4.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.5 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.