bugGNU GRUB - Bugs: bug #41801, Please provide a possibility in...


You are not allowed to post comments on this tracker with your current authentification level.

bug #41801: Please provide a possibility in /etc/default/grub to pass --unrestricted to all menuentries

Submitted by:  Axel Beckert <abe>
Submitted on:  Fri Mar 7 13:18:39 2014  
Votes:  7  
Category: ConfigurationSeverity: Major
Priority: 5 - NormalItem Group: Feature Request
Status: NonePrivacy: Public
Assigned to: NoneOriginator Name: 
Open/Closed: OpenRelease: 
Release: 2.00Reproducibility: None
Planned Release: 2.03+

Fri Mar 7 13:59:17 2014, comment #2:

The attached patch adds a new optional user variable named GRUB_ALL_UNRESTRICTED which, when set to "true" only restricts editing of all menu entries, but not booting them.

I tried to implement this for all /etc/grub.d/ files which add "menuentry" commands, not only for Linux as in the previously mentioned patches.

(file #30817)

Axel Beckert <abe>
Fri Mar 7 13:33:15 2014, comment #1:

The patch in the RedHat bug report seems to revert the default which seems not wanted by the Grub developers.

I'll try to come up with a less invasive patch which keeps the new default and which is based on the current git HEAD.

Axel Beckert <abe>
Fri Mar 7 13:18:39 2014, original submission:

This is more or less a followup to these two bug reports:

From Grub 1.99 to 2.00 the way password protection is handled was changed on purpose. See Vladimir's comments on the bug reports above.

Nevertheless the old behaviour (now possible with the --unrestricted option of menuentry) is vital for deployments of Linux workstations in enterprises and universities and hence missed in many distributions:

The following paragraphs are a citation from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708181#32:

Within the Red Hat bug report for this issue, a solution was
proposed[0] that seems to be simple yet clean: make the behavior
configurable by introducing a GRUB_RESTRICTED variable. This way, the
new (much stricter) behavior can be used by default, yet one can still
revert back to the old behavior with a simple change in /etc/default/grub.

This change in default behavior really is a bad oversight. There no
longer seems to be a way to generally protect menu entries from
editing only, as there has been for ages before. With the new
behavior, this is only possible by changing /etc/grub.d/10_linux, or
the final grub.conf itself.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=840204#c32

Please apply this patch to allow administrators to easily configure the previous behaviour without having to edit 10_linux or grub.cfg itself.

Axel Beckert <abe>


Attached Files
file #30817:  0001-Introduce-GRUB_ALL_UNRESTRICTED-to-only-restrict-edi.patch added by abe (6kB - text/x-patch - Patch against git HEAD with support for all OS, not only Linux)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by phcoder (Updated the item)
  • -unavailable- added by vagnerr (Voted in favor of this item)
  • -unavailable- added by dgeo (Voted in favor of this item)
  • -unavailable- added by mdailey (Voted in favor of this item)
  • -unavailable- added by abe (Submitted the item)
  • -unavailable- added by abe

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 7 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun Mar 5 19:04:06 2017phcoderPlanned Release2.02=>2.03+
    Wed Mar 2 12:36:12 2016phcoderPlanned ReleaseNone=>2.02
    Tue Jan 5 11:02:40 2016vagnerrCarbon-Copy-=>Added vagnerr
    Thu Dec 18 20:47:48 2014dgeoCarbon-Copy-=>Added dgeo
    Fri Mar 7 15:08:40 2014mdaileyCarbon-Copy-=>Added mdailey
    Fri Mar 7 13:59:17 2014abeAttached File-=>Added 0001-Introduce-GRUB_ALL_UNRESTRICTED-to-only-restrict-edi.patch, #30817
    Fri Mar 7 13:18:39 2014abeCarbon-Copy-=>Added phcoder

    Back to the top

    Powered by Savane 3.1-cleanup1