Re: [SECURITY PATCH 116/117] templates: Disable the os-prober by default

[Daniel Kiper]

On Tue, Mar 02, 2021 at 10:49:16PM +0100, Didier Spaier wrote:
> Le 02/03/2021 à 19:02, Daniel Kiper a écrit :
> > From: Alex Burmashev <alexander.burmashev@oracle.com>
> > diff --git a/util/grub.d/30_os-prober.in b/util/grub.d/30_os-prober.in
> > index 1b91c102f..80685b15f 100644
> > --- a/util/grub.d/30_os-prober.in
> > +++ b/util/grub.d/30_os-prober.in
> > @@ -26,7 +26,8 @@ export TEXTDOMAINDIR="@localedir@"
> >   . "$pkgdatadir/grub-mkconfig_lib"
> > -if [ "x${GRUB_DISABLE_OS_PROBER}" = "xtrue" ]; then
> > +if [ "x${GRUB_DISABLE_OS_PROBER}" = "xfalse" ]; then
> > +  gettext_printf "os-prober will not be executed to detect other bootable 
> > partitions.\nSystems on them will not be added to the GRUB boot 
> > configuration.\nCheck GRUB_DISABLE_OS_PROBER documentation entry.\n"
> >     exit 0
> >   fi
>
> This is confusing: now to get boot entries from os-prober one have to
> set:
> GRUB_DISABLE_OS_PROBER=true
> in /etc/default/grub.
>
> Either revert that, or (better, in my opinion) label the variable
> GRUB_ENABLE_OS_PROBER and set it to false by default.

When we worked on this patch we considered that. However, after some
thinking we stated that renaming to GRUB_ENABLE_OS_PROBER will make
more confusion. So, we decided to stick to existing name even if it
is not the best one.

> Tested from grub pulled from git master with all patches committed.

Thank you for doing tests.

Daniel