Description
/boot/grub/grub.cfg is the configuration GRUB reads at boot. It is generated by update-grub
and contains every boot entry, the kernel command lines and, when one is set, the PBKDF2 hash
of the boot password.
Ubuntu 24.04 and 26.04 already create the file with mode 0600; 22.04 ships it 0644 and
20.04 0444. From 22.04 on, update-grub keeps the mode of the existing file. On 20.04 it
replaces the file and sets 0444 again whenever no GRUB password is configured, which happens
at every kernel update: there, the restricted mode only lasts with CB-UBU-BOOT-011 applied.
Rationale
A readable password hash can be attacked offline. Restricting the file to root also hides the boot parameters from local users and stops them from learning which protections are enabled.
Impact
None known. GRUB reads the file before the operating system starts.
Applies when
Detected: when: GRUB is the boot loader A scanner reports the control not applicable when one is false.
Setting
| Location | /boot/grub/grub.cfg |
| Default | root:root 0444 (20.04), 0644 (22.04), 0600 (24.04, 26.04) |
| Recommended | root:root, mode 0600 or stricter |
Audit
Run stat -c '%U:%G %a' /boot/grub/grub.cfg. It must print root:root and a mode of 600 or stricter.
Automated: every check must pass. Scanners report each check by its id.
perms
Owner, group and mode of /boot/grub/grub.cfg.
path: /boot/grub/grub.cfg
owner: root
group: root
mode: '0600'
Remediation
Run chown root:root /boot/grub/grub.cfg and chmod 600 /boot/grub/grub.cfg.
| Restart | none |
| Disruption | none |
Rollback
Run chmod 644 /boot/grub/grub.cfg.
perms
Generated from check perms: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- GNU GRUB Manual - Authentication and authorisation GNU Project, vendor-doc, accessed 2026-10-19
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R29) ANSSI, guide, accessed 2026-10-19
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R29 | partial | R29 restricts the whole /boot directory; this control covers the GRUB configuration. |
| NIST SP 800-53 Rev. 55.1.1 | AC-3 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| Common Weakness Enumeration | CWE-732 |
Related controls
- related
CB-UBU-BOOT-011Protect the boot loader configuration with a password
People and lifecycle
| Authors |
|
| Verified | 2026-10-19 by Sn0wAlice on 20.04, Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic, BIOS boot. Fails on a fresh install (0444); fix sets 0400; update-grub sets 0444 again without a GRUB password and keeps the mode with one; kept after reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 22.04, Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic, BIOS boot. Fails on a fresh install (0644); fix sets 0600; mode kept by update-grub and after reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 24.04, Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic, BIOS boot. Passes on a fresh install (0600); mode kept by update-grub. |
| Verified | 2026-10-19 by Sn0wAlice on 26.04, Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic, BIOS boot. Passes on a fresh install (0600); mode kept by update-grub. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-19, 2026-10-19 |
| Translations | fr |
