Restrict access to the boot loader configuration

Description

/boot/grub/grub.cfg is the configuration GRUB reads at boot. It is generated by update-grub and contains every boot entry, the kernel command lines and, when one is set, the PBKDF2 hash of the boot password.

Rationale

A readable password hash can be attacked offline. Restricting the file to root also hides the boot parameters from local users and stops them from learning which protections are enabled.

Impact

None known. GRUB reads the file before the operating system starts, and update-grub keeps the restricted mode when it regenerates the file.

Applies when

Detected: when: GRUB is the boot loader A scanner reports the control not applicable when one is false.

Setting

Audit

Run stat -c '%U:%G %a' /boot/grub/grub.cfg. It must print root:root and a mode of 600 or stricter.

Automated: every check must pass. Scanners report each check by its id.

perms

Owner, group and mode of /boot/grub/grub.cfg.

path: /boot/grub/grub.cfg
owner: root
group: root
mode: '0600'

Remediation

Run chown root:root /boot/grub/grub.cfg and chmod 600 /boot/grub/grub.cfg.

Rollback

Run chmod 644 /boot/grub/grub.cfg.

perms

Generated from check perms: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• GNU GRUB Manual - Authentication and authorisation GNU Project, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R29) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-BOOT-011 Protect the boot loader configuration with a password

People and lifecycle