Details

Set permission on the your boot loaders config file to read and write for root only.

*Rationale*

Setting the permissions to read and write for root only prevents non-root users from

seeing the boot parameters or changing them. Non-root users who read the boot

parameters may be able to identify weaknesses in security upon boot and be able to exploit

them.

Solution

Run the following to set the permissions fro /boot/grub/grub.cfg-# chmod og-rwx /boot/grub/grub.cfg

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/91

This security hardening control applies to the following category of controls within NIST 800-53: System and Information Integrity.This control applies to the following type of system Unix.

References

• 800-53|SI-7(9)
• CSCv6|3.1

Source

• Tenable.com/audits