When using EFI, grub.conf is stored on a vfat partition, so I have to
set the fmask on the partition if I want grub.conf to have 0600 (the
umask, by default, is 0077).
Two thoughts:
1. The STIG actually requires that /etc/grub.conf have correct owner and
file permissions, not /boot/grub.conf or /boot/efi/EFI/redhat/grub.conf
Obviously, /etc/grub.conf is a symlink. Is this something the STIG
should correct or a sign that we're just being more diligent?
2. If I set the fmask on /boot/efi, /boot/efi/EFI/redhat/grub.efi is
also going to have 0600 permissions. Does anyone know if this is a problem?
Once I have some consensus, I should have a patch to add file a file
permissions check that will cover both locations of grub.conf.
Thanks,
Maura Dailey
Show replies by date