From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1Ml22z-0004S4-HN for mharc-grub-devel@gnu.org; Tue, 08 Sep 2009 10:51:53 -0400 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Ml22y-0004RR-6S for grub-devel@gnu.org; Tue, 08 Sep 2009 10:51:52 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1Ml22t-0004PD-2X for grub-devel@gnu.org; Tue, 08 Sep 2009 10:51:51 -0400 Received: from [199.232.76.173] (port=50513 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Ml22s-0004Oq-Jn for grub-devel@gnu.org; Tue, 08 Sep 2009 10:51:46 -0400 Received: from moutng.kundenserver.de ([212.227.126.187]:60786) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1Ml22r-0000l3-3u for grub-devel@gnu.org; Tue, 08 Sep 2009 10:51:45 -0400 Received: from [85.180.10.126] (e180010126.adsl.alicedsl.de [85.180.10.126]) by mrelayeu.kundenserver.de (node=mreu2) with ESMTP (Nemesis) id 0MKv5w-1Ml22p2YdD-0004RB; Tue, 08 Sep 2009 16:51:43 +0200 From: Felix Zielcke To: The development of GRUB 2 In-Reply-To: <20090908144817.GC13674@thorin> References: <1252240143.3895.18.camel@fz.local> <20090906133818.GI13423@riva.ucam.org> <20090908144817.GC13674@thorin> Content-Type: text/plain Date: Tue, 08 Sep 2009 16:51:41 +0200 Message-Id: <1252421501.2872.5.camel@fz.local> Mime-Version: 1.0 X-Mailer: Evolution 2.27.91 Content-Transfer-Encoding: 7bit X-Provags-ID: V01U2FsdGVkX1/1sFG1QBA8f01XBQhM4Nso/4L92Yn23/lV1yY IHcHCiwNIgfSjA5kRVPKM6DEquCLgeHafh/j/caZuWZluAkdyu nHJmMCLWZ1nOFLwdyeNyA== X-detected-operating-system: by monty-python.gnu.org: Genre and OS details not recognized. Subject: Re: chmod of generated grub.cfg X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Sep 2009 14:51:52 -0000 Am Dienstag, den 08.09.2009, 16:48 +0200 schrieb Robert Millan: > On Sun, Sep 06, 2009 at 07:22:36PM +0200, Vladimir 'phcoder' Serbinenko wrote: > > On Sun, Sep 6, 2009 at 3:38 PM, Colin Watson wrote: > > > On Sun, Sep 06, 2009 at 02:29:03PM +0200, Felix Zielcke wrote: > > >> Currently grub-mkconfig uses chmod 444 on the newly generated grub.cfg > > >> Wouldn't it be better to use 400 now that we have plaintext password > > >> support? > > >> Or should we add support for a GRUB_CHMOD variable so users can override > > >> this setting as they please? > > > > > > I'd prefer to see this done only if they set a password. A GRUB_CHMOD > > > variable seems overkill, though. > > Is there a reason a non-root would like to look at grub.cfg on > > production system? Developers can always override chmod. If there is > > no real reason for non-root to look into grub.cfg I would follow the > > best friend in security considerations called "paranoia" and just use > > mode 400 > > I like the idea of using 0400 right away, for simplicity. > > OTOH, world-readable grub.cfg is useful, at least in Debian, because > reportbug includes this file in bug reports. > > But if it's only useful for Debian, we shouldn't let this change our > agenda (ah, the conflict of wearing two hats...). > So in upstream we change it to 400 + warning and for Debian we use my last patch? -- Felix Zielcke Proud Debian Maintainer