Is there any movement on this? This feature request has been open for nearly 10 years

As Axel Beckert stated, this is vital for enterprise Linux workstation deployments.
In its current state, there is no clean way to prevent modifying grub menuentries at boot-time while still allowing users to boot from them.

original submission:

> Please apply this patch to allow administrators to easily configure the previous behaviour without having to edit 10_linux or grub.cfg itself.

The attached patch adds a new optional user variable named GRUB_ALL_UNRESTRICTED which, when set to "true" only restricts editing of all menu entries, but not booting them.

I tried to implement this for all /etc/grub.d/ files which add "menuentry" commands, not only for Linux as in the previously mentioned patches.


(file #30817)

This is more or less a followup to these two bug reports:

• https://savannah.gnu.org/bugs/?func=detailitem&item_id=37020
• https://savannah.gnu.org/bugs/?func=detailitem&item_id=39351

From Grub 1.99 to 2.00 the way password protection is handled was changed on purpose. See Vladimir's comments on the bug reports above.

Nevertheless the old behaviour (now possible with the --unrestricted option of menuentry) is vital for deployments of Linux workstations in enterprises and universities and hence missed in many distributions:

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708181
• https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1050851
• https://bugs.launchpad.net/linuxmint/+bug/1223147
• https://bugzilla.redhat.com/show_bug.cgi?id=840204

The following paragraphs are a citation from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708181#32:

---snip---
Within the Red Hat bug report for this issue, a solution was
proposed[0] that seems to be simple yet clean: make the behavior
configurable by introducing a GRUB_RESTRICTED variable. This way, the
new (much stricter) behavior can be used by default, yet one can still
revert back to the old behavior with a simple change in /etc/default/grub.

This change in default behavior really is a bad oversight. There no
longer seems to be a way to generally protect menu entries from
editing only, as there has been for ages before. With the new
behavior, this is only possible by changing /etc/grub.d/10_linux, or
the final grub.conf itself.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=840204#c32
---snap---

Please apply this patch to allow administrators to easily configure the previous behaviour without having to edit 10_linux or grub.cfg itself.