Verify /boot/grub2/user.cfg User Ownership
Ensures that /boot/grub2/user.cfg, which stores the GRUB 2 superuser password hash, is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Only root should be able to modify important boot parameters. The /boot/grub2/user.cfg file holds the GRUB 2 superuser password hash (PBKDF2). If a non-root user can read or rewrite it, they can extract the hash for offline cracking, or replace it to take unauthorized control of the boot menu, defeating the protection that prevents tampering with kernel command-line arguments (e.g. adding init=/bin/bash to obtain a root shell).
What Pavois checks
Pavois checks that the owner UID of /boot/grub2/user.cfg is 0 (root), but only when the file actually exists (only_if), since it is created only when a GRUB password is configured. The control inspects the effective owner reported by the filesystem (the stat metadata CINC reads live on the target), not a configuration template or a packaging manifest, so it reflects the real state on disk regardless of how the file was created.
only_if { file('/boot/grub/user.cfg').exist? }
describe file('/boot/grub/user.cfg') do
its('uid') { should eq 0 }
endHow to verify it is applied
Confirm the owner with:
stat -c '%U %u' /boot/grub2/user.cfg
Expected output is root 0. The file passes when the numeric UID is 0.
Inspect & investigate
There is no service log for ownership. Audit access and changes via the filesystem metadata:
stat /boot/grub2/user.cfg
ls -l /boot/grub2/user.cfg
If the auditd file-watch framework is enabled, ownership changes (chown) can be tracked by grepping the raw audit log for the path:
grep 'user.cfg' /var/log/audit/audit.log
Remediation
No automated remediation plan is defined for this rule, so it must be applied manually. Restore root ownership with:
chown root:root /boot/grub2/user.cfg
(pavois harden apply will not change this file until a remediation resource is added to the rule.)
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /boot/grub/user.cfg |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Consequences if misconfigured: a readable hash can be cracked offline; a writable file lets an attacker reset the GRUB superuser password and unlock the boot menu, leading to single-user/root access or kernel-parameter tampering.
Precautions before applying: setting the owner back to root is non-disruptive, GRUB always runs as root at boot, so no legitimate process loses access. Do not change the GRUB password itself while fixing ownership, and after any GRUB credential change keep a known-good entry: a superuser password without --unrestricted blocks every boot and can brick a headless host (it hangs at the GRUB prompt). Verify you can still boot before considering the system hardened.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R29 | direct | 2.0 | high |
| CIS | 2.2.6, 1.4.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.5, AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.