From 4166d6d1e60d564be4c3fb2ad530e7a180638e6a Mon Sep 17 00:00:00 2001 From: raja-grewal Date: Wed, 6 Aug 2025 15:53:49 +1000 Subject: [PATCH] Update docs on recovery restrictions --- etc/default/grub.d/41_recovery_restrict.cfg | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/etc/default/grub.d/41_recovery_restrict.cfg b/etc/default/grub.d/41_recovery_restrict.cfg index f54247b..5da19e7 100644 --- a/etc/default/grub.d/41_recovery_restrict.cfg +++ b/etc/default/grub.d/41_recovery_restrict.cfg @@ -7,14 +7,17 @@ ## KSPP=no: not (currently) compliant with recommendations by the KSPP ## If there is no explicit KSPP compliance notice, the setting is not mentioned by the KSPP. -## Disable access to single-user (recovery) mode. +## Disable access to the GRUB single-user (recovery) mode menu entries. ## ## https://forums.kicksecure.com/t/remove-linux-recovery-mode-boot-option-from-default-grub-boot-menu/727 ## GRUB_DISABLE_RECOVERY="true" ## Disable access to Dracut's recovery console. +## Prevents the emergency shell from starting automatically during boot failures. ## +## https://insinuator.net/2025/07/insecure-boot-injecting-initramfs-from-a-debug-shell/ +## https://serverfault.com/questions/554853/how-can-i-secure-the-dracut-shell ## https://forums.kicksecure.com/t/harden-dracut-initramfs-generator-by-disabling-recovery-console/724 ## GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT rd.emergency=halt"