The system boot loader configuration file(s) must be group-owned by root.

From Oracle Linux 6 Security Technical Implementation Guide

Associated with: CCI-000366

SV-65145r2_rule The system boot loader configuration file(s) must be group-owned by root.

Vulnerability discussion

The "root" group is a highly-privileged group. Furthermore, the group-owner of this file should not have any access privileges anyway.

Check content

To check the group ownership of "/boot/grub/grub.conf", run the command: $ ls -lL /boot/etc/grub.conf If properly configured, the output should indicate the group-owner is "root". If it does not, this is a finding.

Fix text

The file "/boot/grub/grub.conf" should be group-owned by the "root" group to prevent destruction or modification of the file. To properly set the group owner of "/boot/grub/grub.conf", run the command: # chgrp root /boot/grub/grub.conf

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.