Verify /boot/grub2/grub.cfg User Ownership
Ensures the GRUB2 boot configuration file /boot/grub2/grub.cfg is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The GRUB2 configuration file /boot/grub2/grub.cfg defines the kernel that boots, its command line and any boot password. If a non-root user can own (and therefore rewrite) this file, an attacker can append parameters such as init=/bin/sh to gain a root shell at boot, disable kernel hardening flags, or remove the GRUB password, turning a local foothold into full control of the machine before any access control is even loaded. Restricting ownership to root (uid 0) ensures only the superuser can alter boot parameters.
What Pavois checks
Pavois inspects the live filesystem object /boot/grub2/grub.cfg and asserts its owner uid is 0. The check is guarded by only_if so it is skipped on systems (e.g. UEFI Debian/Ubuntu) where this path does not exist. Pavois reads the effective owner of the file as the kernel reports it (stat), not a value declared in a config-management manifest, so drift introduced by a manual chown, a restore from backup, or a misbehaving package is caught immediately.
only_if { file('/boot/grub/grub.cfg').exist? }
describe file('/boot/grub/grub.cfg') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /boot/grub2/grub.cfg. Expected output: root 0. You can also use ls -l /boot/grub2/grub.cfg and confirm the third column (owner) reads root.
Inspect & investigate
There is no continuous log for file ownership; query the current state with stat /boot/grub2/grub.cfg. If auditd watches /boot (auditctl -w /boot -p wa), ownership changes appear in /var/log/audit/audit.log, grep for the path with grep grub.cfg /var/log/audit/audit.log.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually: run chown root:root /boot/grub2/grub.cfg as root. (On systems using update-grub/grub2-mkconfig, the file is normally regenerated as root-owned.)
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /boot/grub/grub.cfg |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If the file is owned by a non-root user, that user can rewrite the boot menu and silently compromise the system at the next reboot. Fixing ownership is low-risk: a chown root:root does not change the file's contents and will not break booting. Precaution: confirm the path actually contains the GRUB config (not a symlink to another location) and avoid changing group/permissions at the same time unless intended, so you do not lock out tools that legitimately read it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R29 | direct | 2.0 | high |
| CIS | 1.4.2, 2.2.6 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.5, AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.