The intended behavior of the /etc/grub.d/10_linux script is to add
menu entries (menuentry) to boot the linux partitions.

Before a certain version of grub, having a password set inhibited
the ability to edit entries, and enter in advanced menus.

After a certain version, it also blocked booting any entry.

To maintain backward compatibility, and given that there is no standard
mechanism to manage passwords and authentication in /etc/default and
script, basic entries should be created with --unrestricted option, so they
can boot without a password.

This way, it is the responsibility of users of authentication to edit
scripts as necessary, and doesn't break existing systems by suddenly
requiring a password at boot (think about headless systems).

This should be as simple as changing:

  ...
  else
      echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
  fi

to:

  else
      echo "menuentry --unrestricted '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
  fi

Hello *,

I've been trying to setup password protection for editing Grub menu
entries and ran into the same problem that even booting requires a password.

After a bit of research I found the following link to Fedora's bug tracker:

https://bugzilla.redhat.com/show_bug.cgi?id=840204#c32

It seems like they settled for a solution that looks like this.

Add a new variable to default/grub

/etc/default/grub
GRUB_RESTRICTED="false"

And then setting --unrestricted in /etc/grub.d/10_linux if the variable
is set to "true:

if [ ${GRUB_RESTRICTED} == "true" ]; then
  CLASS="--class gnu-linux --class gnu --class os"
else
  CLASS="--class gnu-linux --class gnu --class os --unrestricted"
fi


Best regards,

Jochen