documentation_complete: true

title:  'All GRUB configuration files must be owned by root'

description: |-
    The files in <tt>{{{ grub2_uefi_boot_path }}}</tt> should
    be owned by the <tt>root</tt> user to prevent
    destruction or modification of the file.
    {{{ describe_file_owner(file=grub2_uefi_boot_path, owner="root") }}}

rationale: |-
    To prevent unauthorized access and modifications to boot configuration.

severity: medium

identifiers:
    cce@rhel10: CCE-89088-9

template:
    name: file_owner
    vars:
        filepath: {{{ grub2_uefi_boot_path }}}/
        uid_or_name: '0'
        file_regex: ^.*$
