What permissions should the /boot directory have?

Question

I have been reading a linux security paper that says we should only give root access to /boot directory. What does mean, in terms of permissions, 'only root access to /boot directory'? If I set up my /boot to 700, a lot of files inside that dir which give permissions to root group and others wont be able to be accessed anymore? (in my case, 294 files has at least read permmission set to others). Should not /boot directory be set up at least to 755? but in this case, it's a world access not only a root access? Actually the question should be: are there some processes other than root which need access to /boot directory? how can I check that? /var/log/boot.log does not give any answer to that So far I understood that a computer starts that way: mother bios/efi checks the hardware and looks for an mbr/boot media.Then it loads the boot loader and gives boot control to it. the boot loader then loads the kernel and gives boot control to it. The kernel starts services (among other things). Does all this performed by only root or by another user or another root group member as well?

The same idea goes for /boot/grub2 directory. This directory has got, by default, permissions set to 700:

ls -ld /boot/grub2 

drwx------. 4 root root 99 Aug 18 19:37 /boot/grub2

and there are numerous files in this dir:

find /boot/grub2 -type f | wc -l 

282

but only 2 of them are not accessible to others

find /boot/grub2 -type f ! -perm /007 -printf '%y %u %g %m %p\n'

f root root 600 /boot/grub2/grubenv

f root root 600 /boot/grub2/user.cfg

so why set /boot/grub2 up to 700 which is incoherent in view of permissions that have been set up inside that directory ?

Tell me what I have missed there please.

Thanx folks!

Answer 1

If your set /boot/grub2 to 700 no files under it regardless of their permissions will be accessible for normal users. No files under this directory are read or used during or after boot. user.cfg contains boot passwords, so protecting this file makes sense but only for local users. In short, I see no reason to override what your distro sets for you by default.

A more important directory is /boot/efi which is set to 700 because it is normally a FAT partition which by default allows everyone to alter files, and you wouldn't want unprivileged users to meddle with your UEFI boot files.

You can set /boot to 755 or 700 but changing your distro defaults makes zero sense. There are no special files right under this directory which local user could read and gain root access. vmlinuz and initrd can be trivially accessed using your package manager or your distro public files.

In short you're obsessing over a security issue which you've made up and which doesn't exist.