On Ubuntu 18.04 it started to work after I added
GRUB_DISABLE_SUBMENU=y
to /etc/default/grub. So essentially the steps are:
Generate password with:
grub-mkpasswd-pbkdf2
Copy the following lines to the end of /etc/grub.d/40_custom and replace the password with the password from the output above. This will password protect grub completely:
set superusers="grubadm"
password_pbkdf2 grubadm grub.pbkdf2.sha512.10000.D23193A0BE80A8D94606716D2DBE18C1AC77563FD87B7DA41824467E9393EBFFAF8B909DFAD83293325016EF6DA112EBAC819B3196F2D9F764F56E037E4EB86A.78AAD14971909106B4BE80AB6BF704804E67D5486966D9A85289E5449F08BD54E55B83B28CF0A4F2B4D486F2136439B7786135B8D59C611BF9DE2CDE965DB791
Allow selection of boot entries for different kernel versions. edit /etc/grub.d/10_linux
and
Insert --unrestricted
after ${CLASS}
in the line echo "menuentry '$(title "$os" [...]
in function linux_entry in /etc/grub.d/10_linux
, e.g.
echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} --unrestricted \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
Insert --unrestricted
after ${CLASS}
in the line ´echo "menuentry '$(echo "$os" [...]in function linux_entry in
/etc/grub.d/10_linux`, e.g.
echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} --unrestricted \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/"
Add the following line to /etc/default/grub
GRUB_DISABLE_SUBMENU=y
Rebuild grub conf file by executing
update-grub
lock
feature).update-grub
and rebooted I was prompted for password unconditionally.lock
feature? I looked both in the official manual and the Ubuntu specific but it does not mention any lock option.