# Ensure group root is the only GID 0 group

Necessity: The Group ID (GID) of 0 is reserved for the 'root' group, which grants the highest level of privileges on a Linux system. Allowing other groups to have a GID of 0 is a critical security risk. It violates the principle of least privilege and can lead to unauthorized privilege escalation. An attacker who compromises an account belonging to a secondary GID 0 group could gain full root access, bypassing security controls. This misconfiguration also complicates system administration and auditing, making it difficult to track which accounts possess root-level permissions. Auditing and Remediation: The audit script inspects the '/etc/group' file, the standard location for group information, and identifies every entry where the GID is set to 0. The remediation script corrects this misconfiguration by ensuring only the standard 'root' group has GID 0. It modifies any other groups with GID 0, assigning them a new, unique, non-privileged GID to revoke their unintended root-level access. Recommended State Rationale: For this control, there is only one correct and secure state. The 'root' group is the universally accepted standard for GID 0. Any deviation introduces significant security vulnerabilities. Therefore, the Basic, Moderate, and Strict levels all mandate the same configuration: only the 'root' group may have GID 0. There is no acceptable 'less secure' state for this fundamental security principle.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['root']` |
| **Moderate** | `['root']` |
| **Strict** | `['root']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that parses the '/etc/group' file to find all groups with a Group ID (GID) of 0. The script must output only a space-separated list of the names of these groups, with no additional text or formatting.

## Remediation Script Working

shell script that accepts one positional argument: the name of the group that is authorized to have GID 0 (e.g., 'root'). The script must find any other groups in '/etc/group' with a GID of 0, change their GID to a new, unused GID above 1000, and ensure no users are left with an invalid primary group. The script must return 'true' if, after execution, only the specified group has GID 0, and 'false' otherwise.

