Thank you for using Ubuntu and reporting a bug. The user can enter
rescue mode without going through the dpkg option by accessing the root
option in the recovery menu in the first place. The real issue here is
that the user has physical access to the machine. While one can lock
down the BIOS, set BIOS passwords, reconfigure grub and set a root
password (if you decide to set a root password, you should be prompted
for it in rescue mode), you'll still want to remove physical access as
well. An attacker with physical access can bypass any grub restrictions
easily (eg with bootable media or removing the hard drive).
** Changed in: grub (Ubuntu)
Status: New => Won't Fix
** Visibility changed to: Public
** This bug is no longer flagged as a security vulnerability
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1011786
Title:
The "dpkg" option in the Grub Rescue Prompt can be used to gain root
access
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub/+bug/1011786/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
