# Ensure access to bootloader config is configured

Necessity: Securing the bootloader is a critical step in preventing unauthorized access to a system, especially for systems where an attacker may have physical access. An unprotected bootloader (GRUB2) can be manipulated to boot the system into single-user mode to gain root privileges, modify kernel parameters to disable security controls like SELinux, or boot from an alternate medium to access the filesystem. Requiring a password prevents such unauthorized modifications.

Auditing and Remediation: The audit script verifies that the two primary components of bootloader security are in place: restrictive file permissions on the configuration file (`grub.cfg`) to prevent tampering by unprivileged local users, and the presence of a superuser password to protect the boot menu itself. The remediation script enforces these controls by using standard system utilities (`chown`, `chmod`, `grub2-setpassword`) to set the correct permissions and guide the administrator through setting a strong password.

Recommended State Rationale: Basic, Moderate, and Strict states are all set to 'Configured'. This control is binary; the bootloader is either secured or it is not. There is no lesser or intermediate state that provides meaningful protection. The 'Configured' state, as defined by CIS Benchmarks, requires both proper file permissions and a password. Implementing this control is a foundational hardening step to protect the system's integrity from the very beginning of the boot process.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Configured']` |
| **Moderate** | `['Configured']` |
| **Strict** | `['Configured']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that audits the GRUB2 bootloader configuration. The script must check two conditions: 1) The permissions on `/boot/grub2/grub.cfg` are `600` (or more restrictive) and the file is owned by `root`. 2) A bootloader superuser is defined, which can be verified by checking for a non-empty `set superusers` line in `/boot/grub2/grub.cfg`. The script should return the string 'Configured' if both conditions are met, and 'Not Configured' otherwise. The output must consist only of this string.

## Remediation Script Working

Bash script that secures the GRUB2 bootloader. The script must not accept any arguments. It should perform the following actions: 1) Set the ownership of `/boot/grub2/grub.cfg` to `root:root`. 2) Set the permissions of `/boot/grub2/grub.cfg` to `600`. 3) Execute `grub2-setpassword` to interactively prompt the administrator to create a password for the default `root` superuser. 4) Regenerate the main grub configuration file. The script must return `true` on success and `false` if any step fails.

