bugGNU GRUB - Bugs: bug #41801, Please provide a possibility in...


You are not allowed to post comments on this tracker with your current authentication level.

bug #41801: Please provide a possibility in /etc/default/grub to pass --unrestricted to all menuentries

Submitted by:  Axel Beckert <abe>
Submitted on:  Fri 07 Mar 2014 01:18:39 PM UTC  
Votes:  8  
Category:  Configuration Severity:  Major
Priority:  5 - Normal Item Group:  Feature Request
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release: 
Release:  2.00 Reproducibility:  None
Planned Release:  2.03+

Fri 07 Mar 2014 01:59:17 PM UTC, comment #2:

The attached patch adds a new optional user variable named GRUB_ALL_UNRESTRICTED which, when set to "true" only restricts editing of all menu entries, but not booting them.

I tried to implement this for all /etc/grub.d/ files which add "menuentry" commands, not only for Linux as in the previously mentioned patches.

(file #30817)

Axel Beckert <abe>
Fri 07 Mar 2014 01:33:15 PM UTC, comment #1:

The patch in the RedHat bug report seems to revert the default which seems not wanted by the Grub developers.

I'll try to come up with a less invasive patch which keeps the new default and which is based on the current git HEAD.

Axel Beckert <abe>
Fri 07 Mar 2014 01:18:39 PM UTC, original submission:

This is more or less a followup to these two bug reports:

From Grub 1.99 to 2.00 the way password protection is handled was changed on purpose. See Vladimir's comments on the bug reports above.

Nevertheless the old behaviour (now possible with the --unrestricted option of menuentry) is vital for deployments of Linux workstations in enterprises and universities and hence missed in many distributions:

The following paragraphs are a citation from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708181#32:

Within the Red Hat bug report for this issue, a solution was
proposed[0] that seems to be simple yet clean: make the behavior
configurable by introducing a GRUB_RESTRICTED variable. This way, the
new (much stricter) behavior can be used by default, yet one can still
revert back to the old behavior with a simple change in /etc/default/grub.

This change in default behavior really is a bad oversight. There no
longer seems to be a way to generally protect menu entries from
editing only, as there has been for ages before. With the new
behavior, this is only possible by changing /etc/grub.d/10_linux, or
the final grub.conf itself.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=840204#c32

Please apply this patch to allow administrators to easily configure the previous behaviour without having to edit 10_linux or grub.cfg itself.

Axel Beckert <abe>


Attached Files
file #30817:  0001-Introduce-GRUB_ALL_UNRESTRICTED-to-only-restrict-edi.patch added by abe (6KiB - text/x-patch - Patch against git HEAD with support for all OS, not only Linux)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by frx (Voted in favor of this item)
  • -email is unavailable- added by phcoder (Updated the item)
  • -email is unavailable- added by vagnerr (Voted in favor of this item)
  • -email is unavailable- added by dgeo (Voted in favor of this item)
  • -email is unavailable- added by mdailey (Voted in favor of this item)
  • -email is unavailable- added by abe (Submitted the item)
  • -email is unavailable- added by abe

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 8 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-10-20 frx Carbon-Copy- => Added frx
    2017-03-05 phcoder Planned Release2.02 => 2.03+
    2016-03-02 phcoder Planned ReleaseNone => 2.02
    2016-01-05 vagnerr Carbon-Copy- => Added vagnerr
    2014-12-18 dgeo Carbon-Copy- => Added dgeo
    2014-03-07 mdailey Carbon-Copy- => Added mdailey
    2014-03-07 abe Attached File- => Added 0001-Introduce-GRUB_ALL_UNRESTRICTED-to-only-restrict-edi.patch, #30817
    2014-03-07 abe Carbon-Copy- => Added phcoder

    Back to the top

    Powered by Savane 3.3