# Ensure root is the only GID 0 account

Necessity: The Group ID (GID) of 0 is reserved for the 'root' group, which possesses the highest level of system privileges. Assigning GID 0 to any other group grants it root-level access to files and resources, creating a severe security vulnerability. This misconfiguration could lead to unauthorized privilege escalation, as an attacker compromising a non-root account in a secondary GID 0 group could gain full system control. Enforcing a single GID 0 group is critical to maintaining the principle of least privilege and preventing security boundary violations.

Auditing and Remediation: The audit script inspects the system's group database to verify which group name is assigned GID 0. The remediation script corrects any deviations by removing unauthorized or duplicate group entries with GID 0, ensuring that only the legitimate 'root' group is associated with it.

Recommended State Rationale: The recommendation for all security levels (Basic, Moderate, and Strict) is unequivocally `['root']`. There is no acceptable alternative or gradation for this setting. The integrity and security of a Unix-like operating system depend on a single, well-defined superuser group. Any other configuration is a critical misconfiguration that must be remediated immediately. Therefore, all levels mandate the same secure state.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the system's group database (e.g., /etc/group) to find the group name associated with GID 0. The script must return only the group name as a single string, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single argument: the name of the group that should uniquely have GID 0 (e.g., 'root'). The script must find all other group entries with GID 0 and remove them, ensuring only the specified group has that GID. The script must return `true` on successful completion or if no changes were needed, and `false` on failure.

