[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v1 19/37] grub-set-password.in: Add friendly grub2 password confi
From: |
Leo Sandoval |
Subject: |
[PATCH v1 19/37] grub-set-password.in: Add friendly grub2 password config tool (#985962) |
Date: |
Mon, 7 Oct 2024 12:20:52 -0600 |
From: Robert Marshall <rmarshall@redhat.com>
Provided a tool for users to reset the grub2 root user password
without having to alter the grub.cfg. The hashed password now
lives in a root-only-readable configuration file.
Resolves: rhbz#985962
Signed-off-by: Robert Marshall <rmarshall@redhat.com>
[pjones: fix the efidir in grub-setpassword and rename tool]
Signed-off-by: Peter Jones <pjones@redhat.com>
[luto: fix grub-setpassword -o's output path]
Signed-off-by: Andy Lutomirski <luto@kernel.org>
[rharwood: migrate man page to h2m, context]
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
---
Makefile.util.def | 13 ++++
configure.ac | 1 +
docs/man/grub-set-password.h2m | 2 +
util/grub-mkconfig.in | 2 +
util/grub-set-password.in | 121 +++++++++++++++++++++++++++++++++
util/grub.d/01_users.in | 11 +++
6 files changed, 150 insertions(+)
create mode 100644 docs/man/grub-set-password.h2m
create mode 100644 util/grub-set-password.in
create mode 100644 util/grub.d/01_users.in
diff --git a/Makefile.util.def b/Makefile.util.def
index 09bfcadd9..95884956a 100644
--- a/Makefile.util.def
+++ b/Makefile.util.def
@@ -455,6 +455,12 @@ script = {
installdir = grubconf;
};
+script = {
+ name = '01_users';
+ common = util/grub.d/01_users.in;
+ installdir = grubconf;
+};
+
script = {
name = '10_windows';
common = util/grub.d/10_windows.in;
@@ -733,6 +739,13 @@ script = {
installdir = sbin;
};
+script = {
+ name = grub-set-password;
+ common = util/grub-set-password.in;
+ mansection = 8;
+ installdir = sbin;
+};
+
script = {
name = grub-mkconfig_lib;
common = util/grub-mkconfig_lib.in;
diff --git a/configure.ac b/configure.ac
index ae3a49321..493e336ec 100644
--- a/configure.ac
+++ b/configure.ac
@@ -77,6 +77,7 @@ grub_TRANSFORM([grub-mkrelpath])
grub_TRANSFORM([grub-mkrescue])
grub_TRANSFORM([grub-probe])
grub_TRANSFORM([grub-reboot])
+grub_TRANSFORM([grub-set-password])
grub_TRANSFORM([grub-script-check])
grub_TRANSFORM([grub-set-default])
grub_TRANSFORM([grub-sparc64-setup])
diff --git a/docs/man/grub-set-password.h2m b/docs/man/grub-set-password.h2m
new file mode 100644
index 000000000..10ee82f4d
--- /dev/null
+++ b/docs/man/grub-set-password.h2m
@@ -0,0 +1,2 @@
+[NAME]
+grub-set-password \- generate the user.cfg file containing the hashed grub
bootloader password
diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in
index d1bf4983b..9d5d7964b 100644
--- a/util/grub-mkconfig.in
+++ b/util/grub-mkconfig.in
@@ -283,6 +283,8 @@ for i in "${grub_mkconfig_dir}"/* ; do
*~) ;;
# emacsen autosave files. FIXME: support other editors
*/\#*\#) ;;
+ # rpm config files of yore.
+ *.rpmsave|*.rpmnew|*.rpmorig) ;;
*)
if grub_file_is_not_garbage "$i" && test -x "$i" ; then
echo
diff --git a/util/grub-set-password.in b/util/grub-set-password.in
new file mode 100644
index 000000000..d8005e5a1
--- /dev/null
+++ b/util/grub-set-password.in
@@ -0,0 +1,121 @@
+#!/bin/sh -e
+
+grubdir=`echo "/@bootdirname@/@grubdirname@" | sed 's,//*,/,g'`
+
+PACKAGE_VERSION="@PACKAGE_VERSION@"
+PACKAGE_NAME="@PACKAGE_NAME@"
+self=`basename $0`
+bindir="@bindir@"
+grub_mkpasswd="${bindir}/@grub_mkpasswd_pbkdf2@"
+
+# Usage: usage
+# Print the usage.
+usage () {
+ cat <<EOF
+Usage: $0 [OPTION]
+$0 prompts the user to set a password on the grub bootloader. The password
+is written to a file named user.cfg which lives in the GRUB directory
+located by default at ${grubdir}.
+
+ -h, --help print this message and exit
+ -v, --version print the version information and exit
+ -o, --output_path <DIRECTORY> put user.cfg in a user-selected directory
+
+Report bugs at https://bugzilla.redhat.com.
+EOF
+}
+
+argument () {
+ opt=$1
+ shift
+
+ if test $# -eq 0; then
+ gettext_printf "%s: option requires an argument -- \`%s'\n" "$self"
"$opt" 1>&2
+ exit 1
+ fi
+ echo $1
+}
+
+# Ensure that it's the root user running this script
+if [ "${EUID}" -ne 0 ]; then
+ echo "The grub bootloader password may only be set by root."
+ usage
+ exit 2
+fi
+
+# Check the arguments.
+while test $# -gt 0
+do
+ option=$1
+ shift
+
+ case "$option" in
+ -h | --help)
+ usage
+ exit 0 ;;
+ -v | --version)
+ echo "$self (${PACKAGE_NAME}) ${PACKAGE_VERSION}"
+ exit 0 ;;
+ -o | --output)
+ OUTPUT_PATH=`argument $option "$@"`; shift ;;
+ --output=*)
+ OUTPUT_PATH=`echo "$option" | sed 's/--output=//'` ;;
+ -o=*)
+ OUTPUT_PATH=`echo "$option" | sed 's/-o=//'` ;;
+ esac
+done
+
+# set user input or default path for user.cfg file
+if [ -z "${OUTPUT_PATH}" ]; then
+ OUTPUT_PATH="${grubdir}"
+fi
+
+if [ ! -d "${OUTPUT_PATH}" ]; then
+ echo "${OUTPUT_PATH} does not exist."
+ usage
+ exit 2;
+fi
+
+ttyopt=$(stty -g)
+fixtty() {
+ stty ${ttyopt}
+}
+
+trap fixtty EXIT
+stty -echo
+
+# prompt & confirm new grub2 root user password
+echo -n "Enter password: "
+read PASSWORD
+echo
+echo -n "Confirm password: "
+read PASSWORD_CONFIRM
+echo
+stty ${ttyopt}
+
+getpass() {
+ local P0
+ local P1
+ P0="$1" && shift
+ P1="$1" && shift
+
+ ( echo ${P0} ; echo ${P1} ) | \
+ LC_ALL=C ${grub_mkpasswd} | \
+ grep -v '[eE]nter password:' | \
+ sed -e "s/PBKDF2 hash of your password is //"
+}
+
+MYPASS="$(getpass "${PASSWORD}" "${PASSWORD_CONFIRM}")"
+if [ -z "${MYPASS}" ]; then
+ echo "${self}: error: empty password" 1>&2
+ exit 1
+fi
+
+install -m 0600 /dev/null "${OUTPUT_PATH}/user.cfg" 2>/dev/null || :
+chmod 0600 "${OUTPUT_PATH}/user.cfg" 2>/dev/null || :
+echo "GRUB2_PASSWORD=${MYPASS}" > "${OUTPUT_PATH}/user.cfg"
+
+if ! grep -q "^### BEGIN /etc/grub.d/01_users ###$" "${OUTPUT_PATH}/grub.cfg";
then
+ echo "WARNING: The current configuration lacks password support!"
+ echo "Update your configuration with @grub_mkconfig@ to support this
feature."
+fi
diff --git a/util/grub.d/01_users.in b/util/grub.d/01_users.in
new file mode 100644
index 000000000..db2f44bfb
--- /dev/null
+++ b/util/grub.d/01_users.in
@@ -0,0 +1,11 @@
+#!/bin/sh -e
+cat << EOF
+if [ -f \${prefix}/user.cfg ]; then
+ source \${prefix}/user.cfg
+ if [ -n "\${GRUB2_PASSWORD}" ]; then
+ set superusers="root"
+ export superusers
+ password_pbkdf2 root \${GRUB2_PASSWORD}
+ fi
+fi
+EOF
--
2.46.2
- Re: [PATCH v1 22/37] bootp: New net_bootp6 command, (continued)
- [PATCH v1 23/37] grub-get-kernel-settings.in: Add grub-get-kernel-settings and use it in 10_linux, Leo Sandoval, 2024/10/07
- [PATCH v1 24/37] backtrace: Make grub_fatal() also backtrace, Leo Sandoval, 2024/10/07
- [PATCH v1 30/37] btrfs: grub2-btrfs-03-follow_default, Leo Sandoval, 2024/10/07
- [PATCH v1 27/37] btrfs: Add ability to boot from subvolumes, Leo Sandoval, 2024/10/07
- [PATCH v1 33/37] btrfs: grub2-btrfs-06-subvol-mount, Leo Sandoval, 2024/10/07
- [PATCH v1 19/37] grub-set-password.in: Add friendly grub2 password config tool (#985962),
Leo Sandoval <=
- [PATCH v1 26/37] 30_os-prober.in: just build chainloader entries, don't try any xnu xnu., Leo Sandoval, 2024/10/07
- [PATCH v1 25/37] grub.texi: Make our info pages say "grub2" where appropriate., Leo Sandoval, 2024/10/07
- [PATCH v1 28/37] btrfs: fix a bad null check, Leo Sandoval, 2024/10/07
- [PATCH v1 37/37] chainloader: Use grub_efi_...() memory helpers where reasonable., Leo Sandoval, 2024/10/07
- [PATCH v1 31/37] btrfs: grub2-btrfs-04-grub2-install, Leo Sandoval, 2024/10/07