Bug#243176: Remind user to set appropriate permissions on menu.lst if it contains a password

Christopher Martin Christopher Martin <christopher.martin@utoronto.ca>, 243176@bugs.debian.org
Tue, 14 Jun 2005 10:01:11 -0400


> I suggest that
> - the file /boot/grub/menu.lst automatically generated by grub
>   configuration tools,
> - the example provided in the /usr/share/doc/ documentation,
> - the info documentation about the password command
> remember the ineperimented user to chmod o-r the file before adding
> its own uncrypted password into it.

Better yet, ship menu.lst as 640 by default. This prevents the user from 
unknowingly making the boot password available. It's also one less change 
for sysadmins to have to make.

Cheers,
Christopher Martin