bugGNU GRUB - Bugs: bug #39351, Password Protected Grub Menu...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #39351: Password Protected Grub Menu Entries

Submitted by:  Bobby Martin <bmartin4>
Submitted on:  Thu 27 Jun 2013 04:10:50 PM UTC  
 
Category: SecuritySeverity: Major
Priority: 5 - NormalItem Group: Feature Request
Status: InvalidPrivacy: Public
Assigned to: NoneOriginator Name: Bobby Martin
Open/Closed: ClosedRelease: 
Release: otherReproducibility: Every Time
Planned Release: None

Thu 27 Jun 2013 05:19:29 PM UTC, comment #1:

http://www.gnu.org/software/grub/manual/grub.html#menuentry

Vladimir Serbinenko <phcoder>
Project Administrator
Thu 27 Jun 2013 04:10:50 PM UTC, original submission:

Background and Attempts:
I am in charge of securing multiple labs that all run Ubuntu 12.04. As part of securing them, the ability to edit menu entries were password protected and the recovery menu entries were removed. However, users could still reboot their system and the default entry would boot without a prompt for a username and password.

We are wanting to upgrade all of the computers to Ubuntu 13.04, however this configuration of grub no longer seems possible.
According to https://help.ubuntu.com/community/Grub2/Passwords :

"To protect one or more menu items:
Each menuentry to be protected must include information on its title line as to which users should be granted access.
In Ubuntu Precise or earlier, if no user(s) are designated for a specific menuentry, access to that entry will be given to all users.
In Ubuntu Quantal or later, if no user(s) are designated for a specific menuentry, access to that entry will be limited to the superuser."

I have made various attempts to configure grub in a way that allows me to get this old functionality back, however it does not seem to be possible
in this new version of grub. I have only been able to configure it in a way that forces me to set a user and password, which is not an acceptable solution since these labs are used by a large number of people and distributing a generic account is not something we are willing to do, since the functionality we need was at one time possible.

Observed Actions:
Grub will not boot the standard entry without a username and prompt being specified.
To edit the entry the superuser name and password must be specified.

Expected Results:
Grub will boot the standard entry without a username and prompt.
To edit the entry the superuser name and password must be specified.

Is there anyway that the old functionality of grub be implemented in this newer version of grub?
The version of grub-pc in use in Ubuntu Raring is 2.00-13Ubuntu3
The version of grub-pc in use in Ubuntu Precise is 1.99-21Ubuntu3.9

Bobby Martin <bmartin4>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by phcoder (Posted a comment)
  • -unavailable- added by bmartin4 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 27 Jun 2013 05:19:29 PM UTCphcoderStatusNone=>Invalid
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup