documentation_complete: true

prodtype: rhel7

title: 'Verify /boot/efi/EFI/redhat/grub.cfg Group Ownership'

description: |-
    The file <tt>/boot/efi/EFI/redhat/grub.cfg</tt> should
    be group-owned by the <tt>root</tt> group to prevent
    destruction or modification of the file.
    <filegroupowner-desc-macro file="/boot/efi/EFI/redhat/grub.cfg" group="root" />

rationale: |-
    The <tt>root</tt> group is a highly-privileged group. Furthermore, the group-owner of this
    file should not have any access privileges anyway.

severity: medium

identifiers:
    cce@rhel7: TBD

references:
    cis: 1.4.1
    cjis: 5.5.2.2
    cui: 3.4.5
    disa: 225
    nist: AC-6(7)
    pcidss: Req-7.1

ocil: '<filegroupowner-check-macro file="/boot/efi/EFI/redhat/grub.cfg" group="root" />'
