Bug#584822: grub2: command password

[Colin Watson]

On Tue, Jun 08, 2010 at 07:46:10PM +0200, Artificius wrote:
> Many thanks for your explanations, although they are a bit
> sophisticated... I had to make several trials until I succeeded. Saying
> "this will involve editing /etc/grub.d/10_linux" is misleading, as this
> file contains a script source of bash commands which cannot changed
> simply like any text. You'd rather give yet more clear hints that in
> /boot/grub/grub.cfg the 'password' command[s] must positioned directly
> before the 'menuentry' commands

I don't think the positioning of password matters; authentication isn't
checked until you actually try to execute a menu entry.

> and that the 'menuentry' commands normally should contain the '--users
> user-xy' option.

We have an upstream bug (https://savannah.gnu.org/task/?7670) which
covers extending grub-mkconfig to deal with this whole thing nicely,
though that still requires some more thought.  In the meantime, I think
at least documenting what grub.cfg should end up looking like should
help a fair bit, although I appreciate that it still isn't as trivial as
it might be.

> Furthermore, it would be helpful if the documentation contains a
> remark about the necessarity to transport the changes in grub.cfg to
> the MBR by 'grub-install ...'.

There's no such necessity.  You need to run grub-install when
/boot/grub/core.img is changed (by whatever cause), but if properly
generated the core image contains enough information to read grub.cfg
off the filesystem at boot time, and it normally does so.  If you change
grub.cfg directly, that change should be reflected at the next boot with
no further work required, and if it doesn't then please file a separate
bug report with full details.

Of course, if you edit /etc/grub.d/10_linux then you do need to run
grub-mkconfig or its wrapper update-grub (not grub-install) for that to
take effect.

Regards,

-- 
Colin Watson                                       [cjwatson at debian.org]