Arch Linux

lahwaacz

Wiki Admin

From: Czech Republic

Registered: 2012-05-29

Posts: 764

grub2 password protection

Yesterday a hard drive in my laptop started to break down, so I backed up everything, installed new hard drive, copied all the data back...
Anyway, everything works fine, but in the process I obviously needed to install grub2 into the new drive. I have this piece of code in /boot/grub/grub.cfg:

### BEGIN /etc/grub.d/01_password-security ###
insmod password
insmod password_pbkdf2
insmod pbkdf2
set superusers="lahwaacz"
password_pbkdf2 lahwaacz grub.pbkdf2.sha512.10000.<some-long-string>
### END /etc/grub.d/01_password-security ###

### BEGIN /etc/grub.d/10_linux ###
menuentry 'Arch Linux GNU/Linux, with Linux core repo kernel' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-core repo kernel-true-ec04b3e5-f796-4661-a0ae-08f803189356' {
	load_video
	insmod gzio
	insmod part_gpt
	insmod ext2
	set root='hd0,gpt2'
	if [ x$feature_platform_search_hint = xy ]; then
	  search --no-floppy --fs-uuid --set=root --hint-bios=hd0,gpt2 --hint-efi=hd0,gpt2 --hint-baremetal=ahci0,gpt2  ec04b3e5-f796-4661-a0ae-08f803189356
	else
	  search --no-floppy --fs-uuid --set=root ec04b3e5-f796-4661-a0ae-08f803189356
	fi
	echo	'Loading Linux core repo kernel ...'
	linux	/boot/vmlinuz-linux root=/dev/sda2 ro  init=/bin/systemd consoleblank=60 pcie_aspm=force resume=/dev/sda2 resume_offset=38912
	echo	'Loading initial ramdisk ...'
	initrd	/boot/initramfs-linux.img
}

In the old disk, it asks for password only when I want to edit some menuentry or when I want to use grub's shell, but in the new disk, it asks for password even before booting the system. I thought that all menu entries are unlocked by default and I'd have to use 'menuentry --users lahwaacz {' to lock the menuentry.

How can I achieve the behaviour of the old disk?