https://bugzilla.novell.com/show_bug.cgi?id=821387 https://bugzilla.novell.com/show_bug.cgi?id=821387#c1 --- Comment #1 from Michael Chang 2013-05-27 05:06:05 UTC --- I think the result is intended. What you're requesting is parallel to measured boot but that's not possible to get generic supported imho (unless platform offers means as tamper-free storage like TPM PCR registers which hashes could be measured into). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=821387 https://bugzilla.novell.com/show_bug.cgi?id=821387#c3 --- Comment #3 from Michael Chang 2013-05-27 09:22:18 UTC --- You need specify --unrestricted to your menuentry to achieve similar experience to grub. See http://www.gnu.org/software/grub/manual/grub.html#Security -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=821387 https://bugzilla.novell.com/show_bug.cgi?id=821387#c5 --- Comment #5 from Michael Chang 2013-05-28 05:51:29 UTC --- (In reply to comment #4)

Thanks for the hint. I manually edited /boot/grub2/grub.cfg to add --unrestricted to each menu entry line (editing the provided 10_linux script for this purpose seemed not to be an easy way).

40_custom script still contains the password settings.

After a reboot I am now non longer being asked for a user/password but on the other hand I also do *not* see the boot menu. Instead the system instantly boots the default boot entry. I tried to type "ESC", "c", "e" when grub starts but this did not change anything.

I also tried and it works pretty good for me. I had the boot menu and when attempting to edit boot entries or entering command line mode it asked me user name and password. But did not when I boot the entries.

Is this the way it should be? Still I do not have a behavior similar to grub1 using "password --md5 <password>".

No. Probably your config file is broken somehow ? Run this to check. $ grub2-script-check /boot/grub2/grub.cfg Or attach your config here to reference. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=821387 https://bugzilla.novell.com/show_bug.cgi?id=821387#c7 --- Comment #7 from Rainer Krienke 2013-05-28 06:32:17 UTC --- Created an attachment (id=541456) --> (http://bugzilla.novell.com/attachment.cgi?id=541456) /etc/grub.d/40_custom 40_custom file with superuser and password_pbkdf2 directives added -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=821387 https://bugzilla.novell.com/show_bug.cgi?id=821387#c9 --- Comment #9 from Michael Chang 2013-05-28 09:38:04 UTC --- (In reply to comment #8)

I ran grub2-script-check /boot/grub2/grub.cfg but the check did not output anything.

That means syntax check passed, no broken indeed.

So I added the main config files as an attachment to this bug report:

/boot/grub2/grub.cfg /etc/grub.d/40_custom

grub.cfg is the default file generated by grub2-mkconfig -o /boot/grub2/grub.cfg from the scripts in /etc/grub.d/ provided by openSuSE 12.3. 40_custom is the file I edited to insert set superuser and password_pbkdf2 directives.

Could you please check your timeout settings ? The resulted behavior is expected from your config. You may have your /etc/default/grub:GRUB_TIMEOUT settings to zero ? In you config : if [ x${boot_once} = xtrue ]; then set timeout=0 elif sleep --interruptible 0 ; then set timeout=0 fi Should looks like below for menu with 8 sec timeout. if [ x${boot_once} = xtrue ]; then set timeout=0 elif sleep --interruptible 0 ; then set timeout=8 fi -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=821387 https://bugzilla.novell.com/show_bug.cgi?id=821387#c11 Michael Chang changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FEATURE --- Comment #11 from Michael Chang 2013-06-04 21:21:18 UTC --- I set to resolved feature and thanks to confirm it. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.