1

I want to prevent the user from modifying the Grub menu when boot(press e key to edit mode) and allow the user can choose any entry to boot.

I refer to some methods like this: https://superuser.com/questions/488275/grub-2-password-protection-in-debian

After setting password, both "choosing entry to boot" and "pressing e key to edit" need password.
After setting password and add"--unrestricted" in every entry, both "choosing entry to boot" and "pressing e key to edit" don't need password.

I try this on Debian 10 and Debian 11. What is the right way to use "--unrestricted"?

1

After setting password and add"--unrestricted" in every entry, both "choosing entry to boot" and "pressing e key to edit" don't need password.

No. If --unrestricted is set on an entry, only booting is allowed without the need to enter username and password. Editing menu entries (e) and the use of the command line (c) is restricted to the users listed in the superusers list.

From the GRUB manual (emphasis mine):

In order to enable authentication support, the ‘superusers’ environment variable must be set to a list of usernames, separated by any of spaces, commas, semicolons, pipes, or ampersands. Superusers are permitted to use the GRUB command line, edit menu entries, and execute any menu entry. If ‘superusers’ is set, then use of the command line and editing of menu entries are automatically restricted to superusers. Setting ‘superusers’ to empty string effectively disables both access to CLI and editing of menu entries.

and furthermore

Other users may be allowed to execute specific menu entries by giving a list of usernames (as above) using the --users option to the ‘menuentry’ command (see menuentry). If the --unrestricted option is used for a menu entry, then that entry is unrestricted. If the --users option is not used for a menu entry, then that only superusers are able to use it.

To be able to boot all entries without password, set set superusers=... (empty list or list of usernames plus one password entry for each user) and add the --unrestricted option to all menu entries.

2
  • But I add "--unrestricted" and still can press "e" to edit Grub menu on Debian 11. – Anthony May 14 at 8:36
  • This should not happen if the superusers variable is set, e.g. add set superusers="anthony" and password anthony 123 to /etc/grub.d/40_custom. Make sure you have --unrestricted set where you want it, for example in /etc/grub.d/10_linux by adding it to the CLASS="..." line. Run sudo update-grub and check if the changes are present in /boot/grub/grub.cfg. Reboot. – Freddy May 14 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.