Rule file_permissions_boot_grub2 fails in Image Mode

[jan-cerny]

Description of problem:

The upstream daily productization run has discovered that rule file_permissions_boot_grub2 fails in these tests on RHEL 10.2:

• /hardening/container/bootc-image-builder/cis
• /hardening/container/bootc-image-builder/cis_workstation_l2
• /hardening/container/anaconda-ostree/cis
• /hardening/container/anaconda-ostree/cis_workstation_l2
• /hardening/container/old-new/cis
• /hardening/container/old-new/cis_workstation_l2

SCAP Security Guide Version:

Current upstream master branch as of 2025-12-17 as of HEAD ef80c11

Operating System Version:

RHEL 10.2 RHEL-10.2-20251216.0

Steps to Reproduce:

1. Deploy a RHEL 10.2 Image Mode system hardened with CIS Server or Workstation Level 2 profile.
2. Run an oscap scan of the deployed system.

Actual Results:

Rule fails in the post-deployment verification scan.

Expected Results:

Rule passes in the post-deployment verification scan.

Additional Information/Debugging Steps:

it could be related to coreos/bootupd#952

[Mab879]

Seems valid. Not sure how we want to fix it. The rule is correctly failing per the benchmark.

[root@localhost ~]# ls -lah /boot/grub2/
total 28K
drwxr-xr-x. 5 root root   99 Jan  8 19:17 .
drwxr-xr-x. 6 root root  112 Jan  8 19:17 ..
-rw-r--r--. 1 root root   53 Jan  8 19:17 bootuuid.cfg
drwxr-xr-x. 2 root root   25 Jan  8 19:17 fonts
-rw-------. 1 root root 3.1K Jan  8 19:17 grub.cfg
-rw-r--r--. 1 root root 1.0K Jan  8 19:17 grubenv
drwxr-xr-x. 2 root root 8.0K Jan  8 19:17 i386-pc
drwxr-xr-x. 2 root root 4.0K Jan  8 19:17 locale

[jan-cerny]

I think we need to talk about this to someone from bootc or bootupd teams, because it's the bootupd component that creates these files in Image Mode.

[Arden97]

One solution would be to restrict file_permissions_boot_grub2 to check only /boot/grub2/grub.cfg and /boot/grub2/user.cfg, as these files could contain password hashes and kernel arguments. Alternatively, we could ask the bootc team to restrict /boot/grub2/bootuuid.cfg and /boot/grub2/grubenv to 0600 permission mode.

[Mab879]

IIRC, only checking those two files doesn't follow at least CIS, if not others.

[Arden97]

I've opened an issue in bootpd project. Let's wait for their responce