# Ensure permissions on /etc/group are configured

Necessity: The `/etc/group` file contains sensitive information about the user groups on the system. Incorrectly permissive settings could allow an unauthorized user to add themselves to a privileged group (e.g., `sudo`), leading to a complete system compromise. Conversely, overly restrictive permissions can disrupt essential system functions that need to resolve group IDs to group names. Proper permissions are critical to prevent privilege escalation while maintaining system stability.

Auditing and Remediation: The audit script instruction is designed to check the current file mode of `/etc/group` in its octal representation (e.g., 644). The remediation script instruction uses the `chmod` command to enforce the specified permission set, ensuring the file is configured correctly.

Recommended State Rationale: A permission set of '644' is the standard and recommended configuration for `/etc/group` across all hardening levels (Basic, Moderate, and Strict), as advised by security benchmarks like CIS. This configuration means the root user (owner) has read/write access, while the root group and all other users have read-only access. This is the optimal balance, as it prevents unauthorized modifications while allowing system processes and users to read group information, which is necessary for many common operations (e.g., `ls -l` displaying group names).

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['644']` |
| **Moderate** | `['644']` |
| **Strict** | `['644']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that uses the `stat -c %a /etc/group` command to retrieve the current octal permissions for the `/etc/group` file. The script must output only the numerical permission value (e.g., '644') and nothing else.

## Remediation Script Working

shell script that accepts a single positional argument representing the desired octal permissions (e.g., '644'). The script must use the `chmod` command to apply these permissions to the `/etc/group` file. It should output `true` if the operation is successful and `false` otherwise.

