From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1MkJCb-00024b-W3 for mharc-grub-devel@gnu.org; Sun, 06 Sep 2009 10:58:50 -0400 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1MkJCa-00023x-FE for grub-devel@gnu.org; Sun, 06 Sep 2009 10:58:48 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1MkJCW-00020q-05 for grub-devel@gnu.org; Sun, 06 Sep 2009 10:58:47 -0400 Received: from [199.232.76.173] (port=38524 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1MkJCV-00020n-Oc for grub-devel@gnu.org; Sun, 06 Sep 2009 10:58:43 -0400 Received: from moutng.kundenserver.de ([212.227.126.187]:55492) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1MkJCV-0001Iv-44 for grub-devel@gnu.org; Sun, 06 Sep 2009 10:58:43 -0400 Received: from [85.180.47.88] (e180047088.adsl.alicedsl.de [85.180.47.88]) by mrelayeu.kundenserver.de (node=mreu1) with ESMTP (Nemesis) id 0MKv1o-1MkJCT1FNP-000HwF; Sun, 06 Sep 2009 16:58:41 +0200 From: Felix Zielcke To: The development of GRUB 2 In-Reply-To: <20090906135742.GJ13423@riva.ucam.org> References: <1252240143.3895.18.camel@fz.local> <20090906133818.GI13423@riva.ucam.org> <1252244626.3895.52.camel@fz.local> <20090906135742.GJ13423@riva.ucam.org> Content-Type: multipart/mixed; boundary="=-TEcHjBvqssojybrPw2sQ" Date: Sun, 06 Sep 2009 16:58:40 +0200 Message-Id: <1252249120.3895.53.camel@fz.local> Mime-Version: 1.0 X-Mailer: Evolution 2.27.91 X-Provags-ID: V01U2FsdGVkX18EK80o4w5T2SQ2DbqxMIVRja1VMQ+yeIIFF2T 5x7YnX4dOxi0uxvfW3jfj8lUOQJHJ2/vigzcA7Q5Hbvf07p5fX L7/G3c7D5GTX27jP2efcw== X-detected-operating-system: by monty-python.gnu.org: Genre and OS details not recognized. Subject: Re: chmod of generated grub.cfg X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Sep 2009 14:58:48 -0000 --=-TEcHjBvqssojybrPw2sQ Content-Type: text/plain Content-Transfer-Encoding: 7bit Am Sonntag, den 06.09.2009, 14:57 +0100 schrieb Colin Watson: > On Sun, Sep 06, 2009 at 03:43:46PM +0200, Felix Zielcke wrote: > > Am Sonntag, den 06.09.2009, 14:38 +0100 schrieb Colin Watson: > > > I think it'd be more sensible to do this in grub-mkconfig itself - it > > > doesn't really fit well into the /etc/grub.d/ hook system, which is > > > really just for generating output. > > > > You mean we check with grep if there's a password line in the generated > > config and then just use chmod 400 instead of 444? > > Sounds good. > > Yeah, that kind of thing. > Ok here's now a patch. Robert do you think this can go into 1.97? -- Felix Zielcke Proud Debian Maintainer --=-TEcHjBvqssojybrPw2sQ Content-Disposition: attachment; filename="chmod.diff" Content-Type: text/x-patch; name="chmod.diff"; charset="UTF-8" Content-Transfer-Encoding: 7bit 2009-09-06 Felix Zielcke * util/grub-mkconfig.in: Make generated config file mode 400 if it contains a password and print a warning if it fails. Index: util/grub-mkconfig.in =================================================================== --- util/grub-mkconfig.in (revision 2574) +++ util/grub-mkconfig.in (working copy) @@ -260,6 +260,11 @@ for i in ${grub_mkconfig_dir}/* ; do esac done +if [ "x${grub_cfg}" != "x" ] && grep -q "^password " ${grub_cfg}.new ; then + chmod 400 ${grub_cfg}.new || grub_warn "Could not make ${grub_cfg}.new readable by only root.\ + This means your password is readable by everyone" +fi + if test "x${grub_cfg}" != "x" ; then # none of the children aborted with error, install the new grub.cfg mv -f ${grub_cfg}.new ${grub_cfg} --=-TEcHjBvqssojybrPw2sQ--