# Ensure group root is the only GID 0 group

Necessity: The 'root' group (GID 0) possesses the highest level of privilege on a Linux system, granting extensive permissions to system resources. Assigning GID 0 to any other group effectively creates an alternate pathway to root-level access. This is a critical security vulnerability, as it allows members of the rogue group to bypass standard security controls, potentially leading to unauthorized privilege escalation, data theft, or complete system compromise. The risk of misconfiguration is severe, as it can create a hidden administrative backdoor.

Auditing and Remediation: The audit script systematically scans the `/etc/group` file, which serves as the local group database, and extracts the names of all groups assigned the numeric GID of 0. The remediation script identifies any group with GID 0 that is not the legitimate 'root' group and executes the `groupdel` command to remove it, thereby closing the privilege escalation vector.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly `['root']`. This is a foundational, non-negotiable security principle based on the concept of least privilege. There is no legitimate operational scenario that requires a group other than 'root' to have GID 0. Any deviation introduces an unacceptable security risk. Therefore, all security hardening levels mandate this singular, correct configuration to ensure system integrity and prevent unauthorized superuser access, a standard reflected in major security benchmarks like CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the `/etc/group` file. The script must parse the file to find all group names associated with Group ID (GID) 0. The output must be a single, comma-separated string of the group name(s) found, with no additional text or formatting.

## Remediation Script Working

Bash script that enforces the security policy that only the 'root' group has a GID of 0. The script must accept a single command-line argument, although it will not be used in the logic. The script will identify any groups other than 'root' that have GID 0 and attempt to remove them using the `groupdel` command. It must return `true` if the system is compliant or was successfully brought into compliance, and `false` if any remediation actions failed.

