Re: Password protecting grub

From	David Wright <deblis@lionunicorn.co.uk>
Newsgroups	linux.debian.user
Subject	Re: Password protecting grub
Date	2016-03-18 16:30 +0100
Message-ID	<re4vD-ca-9@gated-at.bofh.it> (permalink)
References	(5 earlier) <rdnK2-3Gs-25@gated-at.bofh.it> <rdnK2-3Gs-17@gated-at.bofh.it> <rdzBw-3yk-5@gated-at.bofh.it> <rdJrc-1sp-7@gated-at.bofh.it> <re2Nd-6re-23@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri 18 Mar 2016 at 18:59:39 (+0530), Raj Kiran Grandhi wrote:
> > > But, be advised that once you do this, all the menu entries in grub will
> > be
> > > inaccessible until the password is supplied.
> > > It would be nice to have a way of requiring a password only if it
> > required
> > > to boot a non-default entry.
> >
> > That's what
> >       menuentry "May be run by any user" --unrestricted {
> > is for. The documentation example runs thus:
> >
> >
> Yes, I had read through that. But that would mean editing
> /boot/grub/grub.cfg manually and losing the changes every time grub-update
> is run. What I could not figure out was to having the --unrestricted be
> appended automatically for the default entry (In my case, GRUB_DEFAULT=0
> which boots the default kernel) every time grub-update was run.

You've just appended
    set superusers=...
    password ...
to the end of /etc/grub.d/40_custom so carry on typing and add your
    unrestricted/default entry right there:

    set superusers=...
    password ...
    menuentry "May be run by any user" --unrestricted { ...
    ...

Obviously change "May be run by any user" into a more convenient and
obvious string like "normal" and give that name to grub-set-default so
that it gets written into the /boot/grub/grubenv file. (Check that.)
I'm assuming you've got GRUB_DEFAULT=saved in your /etc/default/grub
file (and that you refuse any automatic updating of that file).

Cheers,
David.

Thread

Password protecting grub Himanshu Shekhar <irm2015006@iiita.ac.in> - 2016-03-16 12:40 +0100
  Re: Password protecting grub jdd <jdd@dodin.org> - 2016-03-16 13:10 +0100
    Re: Password protecting grub Himanshu Shekhar <irm2015006@iiita.ac.in> - 2016-03-16 13:20 +0100
      Re: Password protecting grub jdd <jdd@dodin.org> - 2016-03-16 13:30 +0100
        Re: Password protecting grub <tomas@tuxteam.de> - 2016-03-16 13:50 +0100
  Re: Password protecting grub <tomas@tuxteam.de> - 2016-03-16 13:30 +0100
  Re: Password protecting grub David Wright <deblis@lionunicorn.co.uk> - 2016-03-16 15:30 +0100
    Re: Password protecting grub Himanshu Shekhar <irm2015006@iiita.ac.in> - 2016-03-16 17:30 +0100
      Re: Password protecting grub arian <debian@semioptimal.net> - 2016-03-16 17:40 +0100
      Re: Password protecting grub jdd <jdd@dodin.org> - 2016-03-16 18:00 +0100
        Re: Password protecting grub Himanshu Shekhar <irm2015006@iiita.ac.in> - 2016-03-16 18:50 +0100
          Re: Password protecting grub Raj Kiran Grandhi <grajkiran@gmail.com> - 2016-03-17 07:30 +0100
            Re: Password protecting grub David Wright <deblis@lionunicorn.co.uk> - 2016-03-17 18:00 +0100
              Re: Password protecting grub Raj Kiran Grandhi <grajkiran@gmail.com> - 2016-03-18 14:40 +0100
                Re: Password protecting grub David Wright <deblis@lionunicorn.co.uk> - 2016-03-18 16:30 +0100
          Re: Password protecting grub Adam Wilson <moxalt@riseup.net> - 2016-03-17 17:10 +0100
            Re: Password protecting grub Martin Smith <lists@rakupottery.org.uk> - 2016-03-17 18:10 +0100
              Re: Password protecting grub Lisi Reisz <lisi.reisz@gmail.com> - 2016-03-17 18:40 +0100
      Re: Password protecting grub Adam Wilson <moxalt@riseup.net> - 2016-03-17 17:10 +0100

csiph-web