Verify /boot/efi/EFI/redhat/user.cfg User Ownership

Classification:

compliance

Framework:

Control:

Description

The file /boot/efi/EFI/redhat/user.cfg should be owned by the root user to prevent reading or modification of the file.

To properly set the owner of /boot/efi/EFI/redhat/user.cfg, run the command:

$ sudo chown root /boot/efi/EFI/redhat/user.cfg

Rationale

Only root should be able to modify important boot parameters. Also, non-root users who read the boot parameters may be able to identify weaknesses in security upon boot and be able to exploit them.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ -d /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then

chown 0 /boot/efi/EFI/redhat/user.cfg

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Gather the package facts
 package\_facts:
 manager: auto
 tags:
 - CCE-86019-7
 - CJIS-5.5.2.2
 - NIST-800-171-3.4.5
 - NIST-800-53-AC-6(1)
 - NIST-800-53-CM-6(a)
 - PCI-DSS-Req-7.1
 - configure\_strategy
 - file\_owner\_efi\_user\_cfg
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed

- name: Test for existence /boot/efi/EFI/redhat/user.cfg
 stat:
 path: /boot/efi/EFI/redhat/user.cfg
 register: file\_exists
 when:
 - '"/boot/efi" in ansible\_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible\_facts.packages'
 - ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86019-7
 - CJIS-5.5.2.2
 - NIST-800-171-3.4.5
 - NIST-800-53-AC-6(1)
 - NIST-800-53-CM-6(a)
 - PCI-DSS-Req-7.1
 - configure\_strategy
 - file\_owner\_efi\_user\_cfg
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed

- name: Ensure owner 0 on /boot/efi/EFI/redhat/user.cfg
 file:
 path: /boot/efi/EFI/redhat/user.cfg
 owner: '0'
 when:
 - '"/boot/efi" in ansible\_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible\_facts.packages'
 - ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file\_exists.stat is defined and file\_exists.stat.exists
 tags:
 - CCE-86019-7
 - CJIS-5.5.2.2
 - NIST-800-171-3.4.5
 - NIST-800-53-AC-6(1)
 - NIST-800-53-CM-6(a)
 - PCI-DSS-Req-7.1
 - configure\_strategy
 - file\_owner\_efi\_user\_cfg
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed