Grub.conf file permissions

Maura Dailey maura at eclipse.ncsc.mil
Wed Sep 11 17:30:22 UTC 2013


When using EFI, grub.conf is stored on a vfat partition, so I have to 
set the fmask on the partition if I want grub.conf to have 0600 (the 
umask, by default, is 0077).

Two thoughts:

1. The STIG actually requires that /etc/grub.conf have correct owner and 
file permissions, not /boot/grub.conf or /boot/efi/EFI/redhat/grub.conf 
Obviously, /etc/grub.conf is a symlink. Is this something the STIG 
should correct or a sign that we're just being more diligent?

2. If I set the fmask on /boot/efi, /boot/efi/EFI/redhat/grub.efi is 
also going to have 0600 permissions. Does anyone know if this is a problem?

Once I have some consensus, I should have a patch to add file a file 
permissions check that will cover both locations of grub.conf.

Thanks,
Maura Dailey


More information about the scap-security-guide mailing list