bugGNU GRUB - Bugs: bug #41801, Please provide a possibility in...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #41801: Please provide a possibility in /etc/default/grub to pass --unrestricted to all menuentries

Submitted by:  Axel Beckert <abe>
Submitted on:  Fri 07 Mar 2014 01:18:39 PM UTC  
Votes:  1  
 
Category: ConfigurationSeverity: Major
Priority: 5 - NormalItem Group: Feature Request
Status: NonePrivacy: Public
Assigned to: NoneOriginator Name: 
Open/Closed: OpenRelease: 
Release: 2.00Reproducibility: None
Planned Release: None

Fri 07 Mar 2014 01:59:17 PM UTC, comment #2:

The attached patch adds a new optional user variable named GRUB_ALL_UNRESTRICTED which, when set to "true" only restricts editing of all menu entries, but not booting them.

I tried to implement this for all /etc/grub.d/ files which add "menuentry" commands, not only for Linux as in the previously mentioned patches.

(file #30817)

Axel Beckert <abe>
Fri 07 Mar 2014 01:33:15 PM UTC, comment #1:

The patch in the RedHat bug report seems to revert the default which seems not wanted by the Grub developers.

I'll try to come up with a less invasive patch which keeps the new default and which is based on the current git HEAD.

Axel Beckert <abe>
Fri 07 Mar 2014 01:18:39 PM UTC, original submission:

This is more or less a followup to these two bug reports:

From Grub 1.99 to 2.00 the way password protection is handled was changed on purpose. See Vladimir's comments on the bug reports above.

Nevertheless the old behaviour (now possible with the --unrestricted option of menuentry) is vital for deployments of Linux workstations in enterprises and universities and hence missed in many distributions:

The following paragraphs are a citation from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=708181#32:

---snip---
Within the Red Hat bug report for this issue, a solution was
proposed[0] that seems to be simple yet clean: make the behavior
configurable by introducing a GRUB_RESTRICTED variable. This way, the
new (much stricter) behavior can be used by default, yet one can still
revert back to the old behavior with a simple change in /etc/default/grub.

This change in default behavior really is a bad oversight. There no
longer seems to be a way to generally protect menu entries from
editing only, as there has been for ages before. With the new
behavior, this is only possible by changing /etc/grub.d/10_linux, or
the final grub.conf itself.

[0] https://bugzilla.redhat.com/show_bug.cgi?id=840204#c32
---snap---

Please apply this patch to allow administrators to easily configure the previous behaviour without having to edit 10_linux or grub.cfg itself.

Axel Beckert <abe>

 

Attached Files
file #30817:  0001-Introduce-GRUB_ALL_UNRESTRICTED-to-only-restrict-edi.patch added by abe (6kB - text/x-patch - Patch against git HEAD with support for all OS, not only Linux)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mdailey (Voted in favor of this item)
  • -unavailable- added by abe (Submitted the item)
  • -unavailable- added by abe
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 1 encouragement so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 07 Mar 2014 03:08:40 PM UTCmdaileyCarbon-Copy-=>Added mdailey
    Fri 07 Mar 2014 01:59:17 PM UTCabeAttached File-=>Added 0001-Introduce-GRUB_ALL_UNRESTRICTED-to-only-restrict-edi.patch, #30817
    Fri 07 Mar 2014 01:18:39 PM UTCabeCarbon-Copy-=>Added phcoder

    Back to the top


    Powered by Savane 3.1-cleanup