bugGNU GRUB - Bugs: bug #39351, Password Protected Grub Menu...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #39351: Password Protected Grub Menu Entries

Submitter:  Bobby Martin <bmartin4>
Submitted:  Thu 27 Jun 2013 04:10:50 PM UTC
   
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  Feature Request
Status:  Invalid Privacy:  Public
Assigned to:  None Originator Name:  Bobby Martin
Open/Closed:  Closed Release:  other
Release:  Reproducibility:  Every Time
Planned Release:  None

Thu 27 Jun 2013 05:19:29 PM UTC, comment #1: 
Vladimir Serbinenko <phcoder>
Group administrator
Thu 27 Jun 2013 04:10:50 PM UTC, original submission:  

Background and Attempts:
I am in charge of securing multiple labs that all run Ubuntu 12.04. As part of securing them, the ability to edit menu entries were password protected and the recovery menu entries were removed. However, users could still reboot their system and the default entry would boot without a prompt for a username and password.

We are wanting to upgrade all of the computers to Ubuntu 13.04, however this configuration of grub no longer seems possible.
According to https://help.ubuntu.com/community/Grub2/Passwords :

"To protect one or more menu items:
Each menuentry to be protected must include information on its title line as to which users should be granted access.
In Ubuntu Precise or earlier, if no user(s) are designated for a specific menuentry, access to that entry will be given to all users.
In Ubuntu Quantal or later, if no user(s) are designated for a specific menuentry, access to that entry will be limited to the superuser."

I have made various attempts to configure grub in a way that allows me to get this old functionality back, however it does not seem to be possible
in this new version of grub. I have only been able to configure it in a way that forces me to set a user and password, which is not an acceptable solution since these labs are used by a large number of people and distributing a generic account is not something we are willing to do, since the functionality we need was at one time possible.


Observed Actions:
Grub will not boot the standard entry without a username and prompt being specified.
To edit the entry the superuser name and password must be specified.

Expected Results:
Grub will boot the standard entry without a username and prompt.
To edit the entry the superuser name and password must be specified.

Is there anyway that the old functionality of grub be implemented in this newer version of grub?
The version of grub-pc in use in Ubuntu Raring is 2.00-13Ubuntu3
The version of grub-pc in use in Ubuntu Precise is 1.99-21Ubuntu3.9

Bobby Martin <bmartin4>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by phcoder (Posted a comment)
  • -email is unavailable- added by bmartin4 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-06-27 phcoder StatusNone Invalid
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code