From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1MkaBo-0002rp-TM for mharc-grub-devel@gnu.org; Mon, 07 Sep 2009 05:07:08 -0400 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1MkaBm-0002q0-5B for grub-devel@gnu.org; Mon, 07 Sep 2009 05:07:06 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1MkaBh-0002oA-5K for grub-devel@gnu.org; Mon, 07 Sep 2009 05:07:05 -0400 Received: from [199.232.76.173] (port=35727 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1MkaBg-0002o3-Uz for grub-devel@gnu.org; Mon, 07 Sep 2009 05:07:00 -0400 Received: from moutng.kundenserver.de ([212.227.17.8]:61775) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1MkaBg-00051X-7p for grub-devel@gnu.org; Mon, 07 Sep 2009 05:07:00 -0400 Received: from [85.180.16.101] (e180016101.adsl.alicedsl.de [85.180.16.101]) by mrelayeu.kundenserver.de (node=mrbap0) with ESMTP (Nemesis) id 0MKsym-1MkaBd15xu-000mQS; Mon, 07 Sep 2009 11:06:57 +0200 From: Felix Zielcke To: The development of GRUB 2 In-Reply-To: <2e59e6970909061821k22e529dbwd8eabe4d76f2deca@mail.gmail.com> References: <1252240143.3895.18.camel@fz.local> <20090906133818.GI13423@riva.ucam.org> <2e59e6970909061821k22e529dbwd8eabe4d76f2deca@mail.gmail.com> Content-Type: text/plain Date: Mon, 07 Sep 2009 11:06:56 +0200 Message-Id: <1252314416.3008.6.camel@fz.local> Mime-Version: 1.0 X-Mailer: Evolution 2.27.91 Content-Transfer-Encoding: 7bit X-Provags-ID: V01U2FsdGVkX1/WDSsrcHBayuqmR9bhJkfvGkIEhP6EWTMpasR kia3g7GFJ6bVIeNwhoBqItYft5zfnYcKWyN6yQVuhu7c0DLNgg V4++dxdv4EOIYT5Ptm2T3r8HQ6f+/UL X-detected-operating-system: by monty-python.gnu.org: Genre and OS details not recognized. Subject: Re: chmod of generated grub.cfg X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Sep 2009 09:07:06 -0000 Am Sonntag, den 06.09.2009, 20:21 -0500 schrieb richardvoigt@gmail.com: > On Sun, Sep 6, 2009 at 12:22 PM, Vladimir 'phcoder' > Serbinenko wrote: > > On Sun, Sep 6, 2009 at 3:38 PM, Colin Watson wrote: > >> On Sun, Sep 06, 2009 at 02:29:03PM +0200, Felix Zielcke wrote: > >>> Currently grub-mkconfig uses chmod 444 on the newly generated grub.cfg > >>> Wouldn't it be better to use 400 now that we have plaintext password > >>> support? > >>> Or should we add support for a GRUB_CHMOD variable so users can override > >>> this setting as they please? > >> > >> I'd prefer to see this done only if they set a password. A GRUB_CHMOD > >> variable seems overkill, though. > > Is there a reason a non-root would like to look at grub.cfg on > > production system? Developers can always override chmod. If there is > > no real reason for non-root to look into grub.cfg I would follow the > > best friend in security considerations called "paranoia" and just use > > mode 400 > > Shouldn't it be u+rw anyway, or 0600 ? I don't think this would be good. The next grub-mkconfig run would just overwrite your changes you made directly in grub.cfg If any admin wants to do this nevertheless the warning at the top of it, then he can also just change the mode or use with vim for example `:w!' -- Felix Zielcke Proud Debian Maintainer