Verify /boot/efi/EFI/redhat/user.cfg User Ownership
Description
The file /boot/efi/EFI/redhat/user.cfg
should be owned by the root
user to prevent reading or modification of the file.
To properly set the owner of /boot/efi/EFI/redhat/user.cfg
, run the command:
$ sudo chown root /boot/efi/EFI/redhat/user.cfg
Rationale
Only root should be able to modify important boot parameters. Also, non-root users who read
the boot parameters may be able to identify weaknesses in security upon boot and be able to
exploit them.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if [ -d /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
chown 0 /boot/efi/EFI/redhat/user.cfg
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Gather the package facts
package\_facts:
manager: auto
tags:
- CCE-86019-7
- CJIS-5.5.2.2
- NIST-800-171-3.4.5
- NIST-800-53-AC-6(1)
- NIST-800-53-CM-6(a)
- PCI-DSS-Req-7.1
- configure\_strategy
- file\_owner\_efi\_user\_cfg
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- name: Test for existence /boot/efi/EFI/redhat/user.cfg
stat:
path: /boot/efi/EFI/redhat/user.cfg
register: file\_exists
when:
- '"/boot/efi" in ansible\_mounts | map(attribute="mount") | list'
- '"grub2-common" in ansible\_facts.packages'
- ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- CCE-86019-7
- CJIS-5.5.2.2
- NIST-800-171-3.4.5
- NIST-800-53-AC-6(1)
- NIST-800-53-CM-6(a)
- PCI-DSS-Req-7.1
- configure\_strategy
- file\_owner\_efi\_user\_cfg
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed
- name: Ensure owner 0 on /boot/efi/EFI/redhat/user.cfg
file:
path: /boot/efi/EFI/redhat/user.cfg
owner: '0'
when:
- '"/boot/efi" in ansible\_mounts | map(attribute="mount") | list'
- '"grub2-common" in ansible\_facts.packages'
- ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
- file\_exists.stat is defined and file\_exists.stat.exists
tags:
- CCE-86019-7
- CJIS-5.5.2.2
- NIST-800-171-3.4.5
- NIST-800-53-AC-6(1)
- NIST-800-53-CM-6(a)
- PCI-DSS-Req-7.1
- configure\_strategy
- file\_owner\_efi\_user\_cfg
- low\_complexity
- low\_disruption
- medium\_severity
- no\_reboot\_needed