bugGNU GRUB - Bugs: bug #37020, grub password protection behaviour...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #37020: grub password protection behaviour changed? BUG OR FEATURE?

Submitted by:  mate biro <arch_scar>
Submitted on:  Fri 03 Aug 2012 04:42:04 AM UTC  
 
Category: ConfigurationSeverity: Major
Priority: 5 - NormalItem Group: None
Status: InvalidPrivacy: Public
Assigned to: NoneOriginator Name: Mate Biro
Open/Closed: ClosedRelease: 
Release: otherReproducibility: Every Time
Planned Release: None

Fri 10 Aug 2012 08:07:58 PM UTC, comment #3:

The decision to change behaviour was not taken lightly but has a good security reason: entries generated by some additional script should be restricted unless further action taken (secure by default).

Vladimir Serbinenko <phcoder>
Project Administrator
Mon 06 Aug 2012 06:56:50 AM UTC, comment #2:

First of all, thank you.

As you see, I use a rolling-release distro, so I was courious if there was a config file to edit, to put the "--unrestricted" option to my menuentries automatically, as I regenerate my grub.conf file. ( That happens often. ) But nobody explained it.

I will try to figure it out myself.

And I've read the manual. But as the BEHAVIOUR has changed, I did not understood fully, what happened there. ( I'm not the only one, just look around on the web. )

And one last thing. Forums are there to help and to guide.
So, it is RTM, not RTFM. This is what discourages people to ask.

Thank you.

mate biro <arch_scar>
Sat 04 Aug 2012 12:08:21 PM UTC, comment #1:

RTFM.
menuentry --unrestricted "Boot it" {
....
}

Vladimir Serbinenko <phcoder>
Project Administrator
Fri 03 Aug 2012 04:42:04 AM UTC, original submission:

Software version is: grub-common-2.0.0-1
grub-bios-2.0.0-1

Find the original bug post at the arch linux forums.

( https://bbs.archlinux.org/viewtopic.php?id=144572 )

I've newly installed arch on a laptop, and ( paranoid as always ) I wanted to password-protect the menu editing in grub2, as described in the wiki. It always worked until now, but now the entries became password-protected even against booting. (That actually works, when I type in user/password)

What I did was :

generate a hashed pass with

# grub-mkpasswd-pbkdf2

and I've put the following code at the end of /etc/grub.d/00_header:

--------------------------------

cat << EOF

set superusers="myname"
password_pbkdf2 myname grub.pbkdf2.sha512.10000.looooooooooooooongstring

EOF

-------------------------------

I've seen that there was a package update of grub2-common and grub2-bios the 28 june, maybe something has changed upstream?

How can I now setup grub2 to be password-protected only against EDITING and not BOOTING?

[EDIT: I can regenerate the same behaviour on a system running in Virtualbox too.]

mate biro <arch_scar>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by phcoder (Posted a comment)
  • -unavailable- added by arch_scar (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 04 Aug 2012 12:08:21 PM UTCphcoderStatusNone=>Invalid
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1