bugGNU GRUB - Bugs: bug #41801, Please provide a possibility in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #41801: Please provide a possibility in /etc/default/grub to pass --unrestricted to all menuentries

Submitter:  Axel Beckert <abe>
Submitted:  Fri 07 Mar 2014 01:18:39 PM UTC
Votes: 8
 
Category:  Configuration Severity:  Major
Priority:  5 - Normal Item Group:  Feature Request
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  2.00
Release:  Reproducibility:  None
Planned Release:  2.03+

Wed 19 Apr 2023 08:27:55 AM UTC, comment #4: 

Is there any movement on this? This feature request has been open for nearly 10 years

As Axel Beckert stated, this is vital for enterprise Linux workstation deployments.
In its current state, there is no clean way to prevent modifying grub menuentries at boot-time while still allowing users to boot from them.

original submission:

> Please apply this patch to allow administrators to easily configure the previous behaviour without having to edit 10_linux or grub.cfg itself.

jamesps
Sat 22 Jun 2019 04:05:54 PM UTC, comment #3: 

I am attaching an updated patch (tested against version 2.02) which introduces a new optional variable named GRUB_UNRESTRICTED_BOOT (to be placed in the /etc/default/grub file).

Please consider accepting my patch for the next official version of GRUB. I think the patch is simple enough to be below the copyright threshold. Should this turn out to be false, I hereby release my patch under the same licensing terms as GRUB, that is to say under the terms of the GNU General Public License, version 3 or later.

Francesco Poli <frx>
Fri 07 Mar 2014 01:59:17 PM UTC, comment #2: 

The attached patch adds a new optional user variable named GRUB_ALL_UNRESTRICTED which, when set to "true" only restricts editing of all menu entries, but not booting them.

I tried to implement this for all /etc/grub.d/ files which add "menuentry" commands, not only for Linux as in the previously mentioned patches.


(file #30817)

Axel Beckert <abe>
Fri 07 Mar 2014 01:33:15 PM UTC, comment #1: 

The patch in the RedHat bug report seems to revert the default which seems not wanted by the Grub developers.

I'll try to come up with a less invasive patch which keeps the new default and which is based on the current git HEAD.

Axel Beckert <abe>
Fri 07 Mar 2014 01:18:39 PM UTC, original submission:  

This is more or less a followup to these two bug reports:


From Grub 1.99 to 2.00 the way password protection is handled was changed on purpose. See Vladimir's comments on the bug reports above.

Nevertheless the old behaviour (now possible with the --unrestricted option of menuentry) is vital for deployments of Linux workstations in enterprises and universities and hence missed in many distributions:


The following paragraphs are a citation from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708181#32:

---snip---
Within the Red Hat bug report for this issue, a solution was
proposed[0] that seems to be simple yet clean: make the behavior
configurable by introducing a GRUB_RESTRICTED variable. This way, the
new (much stricter) behavior can be used by default, yet one can still
revert back to the old behavior with a simple change in /etc/default/grub.

This change in default behavior really is a bad oversight. There no
longer seems to be a way to generally protect menu entries from
editing only, as there has been for ages before. With the new
behavior, this is only possible by changing /etc/grub.d/10_linux, or
the final grub.conf itself.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=840204#c32
---snap---

Please apply this patch to allow administrators to easily configure the previous behaviour without having to edit 10_linux or grub.cfg itself.

Axel Beckert <abe>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #47121:  grub-unrestricted-boot.patch added by frx (10KiB - text/x-diff - Patch updated against version 2.02)
file #30817:  0001-Introduce-GRUB_ALL_UNRESTRICTED-to-only-restrict-edi.patch added by abe (6KiB - text/x-patch - Patch against git HEAD with support for all OS, not only Linux)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jamesps (Posted a comment)
  • -email is unavailable- added by frx (Posted a comment)
  • -email is unavailable- added by frx (Voted in favor of this item)
  • -email is unavailable- added by phcoder (Updated the item)
  • -email is unavailable- added by vagnerr (Voted in favor of this item)
  • -email is unavailable- added by dgeo (Voted in favor of this item)
  • -email is unavailable- added by mdailey (Voted in favor of this item)
  • -email is unavailable- added by abe (Submitted the item)
  • -email is unavailable- added by abe
  •  

    There are 8 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-06-22 frx Attached File- Added grub-unrestricted-boot.patch, #47121
    2017-10-20 frx Carbon-Copy- Added frx
    2017-03-05 phcoder Planned Release2.02 2.03+
    2016-03-02 phcoder Planned ReleaseNone 2.02
    2016-01-05 vagnerr Carbon-Copy- Added vagnerr
    2014-12-18 dgeo Carbon-Copy- Added dgeo
    2014-03-07 mdailey Carbon-Copy- Added mdailey
    2014-03-07 abe Attached File- Added 0001-Introduce-GRUB_ALL_UNRESTRICTED-to-only-restrict-edi.patch, #30817
    2014-03-07 abe Carbon-Copy- Added phcoder

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code