STIGQter: STIG Summary: Oracle Linux 8 Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

OL 8 operating systems booted with a BIOS must have a unique name for the grub superusers account when booting into single-user and maintenance modes.

DISA Rule

SV-248539r1137691_rule

Vulnerability Number

V-248539

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

OL08-00-010149

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure the system to replace "root" with a unique name for the grub superusers account.

Edit the /etc/grub.d/01_users file and add or modify the following lines:

set superusers="[someuniqueUserNamehere]"
export superusers
password_pbkdf2 [someuniqueUserNamehere] ${GRUB2_PASSWORD}

Generate a new grub.cfg file with the following command:

$ sudo grub2-mkconfig -o /boot/grub2/grub.cfg

Check Contents

For systems that use UEFI, this is Not Applicable.

Verify that a unique name is set as the "superusers" account:

$ sudo grep -iw "superusers" /boot/grub2/grub.cfg
set superusers="[someuniqueUserNamehere]"
export superusers

If "superusers" is identical to any OS account name or is missing a name, this is a finding.

Vulnerability Number

V-248539

Documentable

False

Rule Version

OL08-00-010149

Severity Override Guidance

For systems that use UEFI, this is Not Applicable.

Verify that a unique name is set as the "superusers" account:

$ sudo grep -iw "superusers" /boot/grub2/grub.cfg
set superusers="[someuniqueUserNamehere]"
export superusers

If "superusers" is identical to any OS account name or is missing a name, this is a finding.

Check Content Reference

M

Target Key

5416