寻求更好的解决方案来限制 GRUB2 菜单中的访问

Question

我刚刚读到，在某些情况下，您还应该通过设置密码来保护对 GRUB2 菜单的访问，并且可以通过添加--unrestricted或--users作为菜单项和子菜单的参数来优化访问权限。

我阅读了Ubuntu Community Documentation和Arch Wiki 中的相应页面。因此，我在其中创建/etc/grub.d/01_security、存储了用户名和密码，使文件可执行并运行update-grub. 这是按预期工作的，菜单中的每个操作都会提示输入用户名和密码，但我还想修改自动生成的条目以将它们限制为某些用户（通过--users）或使它们可供所有人使用，但不能由所有人编辑（通过--unrestricted）。

我能够找到正确的行10_linux并相应地编辑它们，但是我很想看到一个更简单的解决方案。也许像GRUB_DISABLE_RECOVERY="true"或GRUB_DISABLE_OS_PROBER=truein这样的选项/etc/default/grub可以轻松（重新）配置（用于 linux 和 os-prober 生成的条目）。

这是与我的 13.10 安装的不同之处：

$ diff /etc/grub.d/10_linux /etc/grub.d/10_linux_bak
123c123
<       echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} --unrestriced \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^$
---
>       echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_inde$
125c125
<       echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} --unrestricted \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_$
---
>       echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
323c323
<     echo "submenu --unrestricted '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' \$menuentry_id_option 'gnulinux-advanced-$boot_device_$
---
>     echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' {"

tl;dr：我很想看到一个简单的解决 GRUB2 条目的解决方案，这些条目在没有密码的情况下无法修改或仅限于某些用户。（是的，GRUB_DISABLE_RECOVERY="true"处于活动状态。）

Answer 1

好吧，我发现变量 in是由in/etc/default/grub读取和导出的。以下补丁是我的想法，希望符合修改后的文件的质量要求和编码标准。补丁应该是类似的，希望明天发布。grub-mkconfig/usr/sbin/30_os-prober

如上所述，变量应该/etc/default/grub像 so GRUB_PWRESTRICTION_LINUX="--users user1"或 so一样定义GRUB_PWRESTRICTION_LINUX="--unrestricted"。

我期待您的反馈。

--- /usr/sbin/grub-mkconfig-orig    2013-10-19 11:22:56.653129020 +0200
+++ /usr/sbin/grub-mkconfig 2013-10-19 11:49:34.961392887 +0200
@@ -230,6 +230,12 @@
   GRUB_ENABLE_CRYPTODISK \
   GRUB_BADRAM \
   GRUB_RECORDFAIL_TIMEOUT
+  GRUB_PWRESTRICTION_LINUX \
+  GRUB_PWRESTRICTION_OS_PROBER_LINUX \
+  GRUB_PWRESTRICTION_OS_PROBER_WINDOWS \
+  GRUB_PWRESTRICTION_OS_PROBER_MACOSX \
+  GRUB_PWRESTRICTION_OS_PROBER_EFI \
+  GRUB_PWRESTRICTION_OS_PROBER_HURD

 if test "x${grub_cfg}" != "x"; then
   rm -f "${grub_cfg}.new"
--- /etc/grub.d/10_linux-orig   2013-10-19 23:28:50.195071600 +0200
+++ /etc/grub.d/10_linux    2013-10-19 23:40:17.429375336 +0200
@@ -120,9 +120,17 @@
      title_correction_code="${title_correction_code}if [ \"x\$default\" = '$quoted' ]; then default='$(echo "$replacement_title" | grub_quote)'; fi;"
      grub_warn "$(gettext_printf "Please don't use old title \`%s' for GRUB_DEFAULT, use \`%s' (for versions before 2.00) or \`%s' (for 2.00 or later)" "$GRUB_ACTUAL_DEFAULT" "$replacement_title" "gnulinux-advanced-$boot_device_id>gnulinux-$version-$type-$boot_device_id")"
       fi
-      echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+      if [ x"${GRUB_PWRESTRICTION_LINUX}" != x ]; then
+        echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} "${GRUB_PWRESTRICTION_LINUX}" \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+      else
+        echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+      fi
   else
-      echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+      if [ x"${GRUB_PWRESTRICTION_LINUX}" != x ]; then
+        echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} "${GRUB_PWRESTRICTION_LINUX}" \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+      else
+        echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
+      fi
   fi      
   echo "recordfail" | sed "s/^/$submenu_indentation/"
   if [ x$type != xrecovery ] ; then
@@ -320,7 +328,11 @@
    boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")"
     fi
     # TRANSLATORS: %s is replaced with an OS name
-    echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' {"
+    if [ x"${GRUB_PWRESTRICTION_LINUX}" != x ]; then
+      echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' "${GRUB_PWRESTRICTION_LINUX}" \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' {"
+    else
+      echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' {"
+    fi
   fi

   linux_entry "${OS}" "${version}" advanced \