# Ensure access to bootloader config is configured

Necessity: The bootloader configuration file (`/boot/grub/grub.cfg`) is critical for system integrity as it controls the boot process, kernel selection, and kernel parameters. Unauthorized modification can lead to system boot failures, bypassing of security controls, or direct root access by altering boot parameters (e.g., `init=/bin/bash`). Restricting access is a fundamental step in preventing privilege escalation and securing the system from its initial startup phase.

Auditing and Remediation: The audit script verifies that the ownership and file permissions of `/boot/grub/grub.cfg` are correctly set. The remediation script uses standard system commands (`chown`, `chmod`) to enforce the secure state, setting the owner and group to 'root' and permissions to '600', which grants read/write access only to the root user.

Recommended State Rationale: The recommended state of `'root:root 600'` is consistently applied across Basic, Moderate, and Strict levels because it represents the principle of least privilege for this critical file. There is no acceptable less-secure state. **Ownership (`root:root`)** ensures only the superuser can manage the file. **Permissions (`600`)** prevents any non-root user from reading potentially sensitive boot information or writing malicious changes. This configuration is a standard requirement in security benchmarks like CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root:root 600']` |
| **Moderate** | `['root:root 600']` |
| **Strict** | `['root:root 600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the ownership and permissions of the `/boot/grub/grub.cfg` file. The script must return a single string in the format 'owner:group permissions_octal' (e.g., 'root:root 600') with no extra text or labels.

## Remediation Script Working

Bash script that accepts a desired state string in the format 'owner:group permissions_octal' as a single command-line argument (e.g., './remediate.sh "root:root 600"'). The script must use `chown` and `chmod` to set the ownership and permissions for the `/boot/grub/grub.cfg` file accordingly. It must return 'true' on success and 'false' on failure.

