/boot/grub/grub.cfg is read protected for regular users. Why?

I was wondering why the file /boot/grub/grub.cfg is read protected. The only thing that comes to my mind is because it can contain a hash of a password if I use grub with a passwd.

I am however not using that feature, and hence I do not think it would be a problem to give world read access to it, or at least my user. I want to be able to read it wihtout sudo, both to simplify my script and avoid dealing with superuser permissions.

Realisticly no one is going to attack my personal pc in such a manner, but I would like to stick to good security practices.

Asked By: Uno Dos


I just checked that file on two different flavors of linux and neither has that file read protected. You don’t mention what OS you are using, so I can’t compare.

At least one of those flavors separates the password hash into a separate file probably specifically so grub.cfg doesn’t have it and can be left world readable.

In addition to your suggested password hash, the file also contains information about contents of other (bootable) partitions that might not be readable to a non-root user, but this type of information is probably not very secret and is probably guessable from output of lsblk (which is not privileged) anyway.

So I don’t see a reason why grub.cfg is not world readable other than paranoia or a simplistic design to protect the hashed password that may or may not be there.

Answered By: user10489

It looks like your guess about confidentiality and passwords was correct: in response to a CVE report about this issue,
since 2021 on upstream the umask is now set to 077 before creating the output file. Whether this is useful depends on your point of view I suppose: I guess that it’s better to err on the side of caution but meh.

Answered By: ErikF
Categories: Answers Tags: ,
Answers are sorted by their score. The answer accepted by the question owner as the best is marked with
at the top-right corner.