Add password protection support for the submenu (#97)

* Add password protection support for the submenu

Grub2 supports superuser and user access using passwords. #95

-Ability to add authorized users.
-Possibility to disable password protection for the submenu.

* Update config

* Update README.md

41_snapshots-btrfs

@@ -58,7 +58,8 @@ grub_btrfs_config="${sysconfdir}/default/grub-btrfs/config"
 grub_btrfs_disable=${GRUB_BTRFS_DISABLE:-"false"}
 [[ "${grub_btrfs_disable}" == "true" ]] && exit 0
 ## Submenu name
-submenuname=${GRUB_BTRFS_SUBMENUNAME:-"Arch Linux snapshots"}
+distro=$(awk -F "=" '/^NAME=/ {gsub(/"/, "", $2); print $2}' /etc/os-release)
+submenuname=${GRUB_BTRFS_SUBMENUNAME:-"${distro:-Linux} snapshots"}
 ## Prefix entry
 prefixentry=${GRUB_BTRFS_PREFIXENTRY:-"Snapshot:"}
 ## Show full path snapshot or only name
@@ -91,6 +92,18 @@ snapper_config=${GRUB_BTRFS_SNAPPER_CONFIG:-"root"}
 override_boot_partition_detection=${GRUB_BTRFS_OVERRIDE_BOOT_PARTITION_DETECTION:-"false"}
 ## Customize GRUB directory
 grub_directory=${GRUB_BTRFS_DIRNAME:-"grub"}
+## Password protection management for submenu
+# Protection support for submenu (--unrestricted)
+unrestricted_access_submenu=${GRUB_BTRFS_DISABLE_PROTECTION_SUBMENU:-"false"}
+case "${unrestricted_access_submenu}" in
+	true)	unrestricted_access_submenu="--unrestricted ";;
+	*)		unrestricted_access_submenu=""
+esac
+# Authorized users (--users foo,bar)
+protection_authorized_users=${GRUB_BTRFS_PROTECTION_AUTHORIZED_USERS}
+if [ ! -z "${protection_authorized_users}" ] ; then
+	protection_authorized_users="--users ${GRUB_BTRFS_PROTECTION_AUTHORIZED_USERS} "
+fi
 
 ########################
 ### variables script ###
@@ -152,6 +165,7 @@ test_btrfs()
 	fi
 	set -e
 }
+
 ##############
 ### Script ###
 ##############
@@ -189,10 +203,10 @@ make_menu_entries()
 			for u in "${name_microcode[@]}"; do
 				if [[ -f "${boot_dir}"/"${u}" && "${i}" != "${prefix_i}-${kversion}-${alt_suffix_i}" ]] ; then
 				entry "
-	menuentry '"${k}" & "${i}" & "${u}"' ${CLASS} "\$menuentry_id_option" 'gnulinux-snapshots-$boot_uuid'{"
+	menuentry '"${k}" & "${i}" & "${u}"' ${CLASS} "\$menuentry_id_option" 'gnulinux-snapshots-$boot_uuid' {"
 				else
 				entry "
-	menuentry '"${k}" & "${i}"' ${CLASS} "\$menuentry_id_option" 'gnulinux-snapshots-$boot_uuid'{"
+	menuentry '"${k}" & "${i}"' ${CLASS} "\$menuentry_id_option" 'gnulinux-snapshots-$boot_uuid' {"
 				fi
 				entry "\
 		if [ x\$feature_all_video_module = xy ]; then
@@ -207,7 +221,7 @@ make_menu_entries()
 		fi
 		echo 'Loading Snapshot: "${snap_date_time}" "${snap_dir_name}"'
 		echo 'Loading Kernel: "${k}" ...'
-		linux \"${boot_dir_root_grub}/"${k}"\" root="${LINUX_ROOT_DEVICE}" rw rootflags=subvol=\""${snap_dir_name}"\" ${kernel_parameters}"
+		linux \"${boot_dir_root_grub}/"${k}"\" root="${LINUX_ROOT_DEVICE}" rw ${kernel_parameters} rootflags=subvol=\""${snap_dir_name}"\""
 				if [[ -f "${boot_dir}"/"${u}" && "${i}" != "${prefix_i}-${kversion}-${alt_suffix_i}" ]] ; then
 					entry "\
 		echo 'Loading Microcode & Initramfs: "${u}" "${i}" ...'
@@ -238,12 +252,17 @@ snapshot_list()
 {
 	# Query info from snapper if it is installed
 	type snapper >/dev/null 2>&1
-	if [[ $? -eq 0 ]]; then
-		local snapper_ids=($(snapper -t 0 -c "$snapper_config" list | tail -n +3 | cut -d'|' -f 1))
-		local snapper_types=($(snapper -t 0 -c "$snapper_config" list | tail -n +3 | cut -d'|' -f 2))
+	if [ $? -eq 0 ]; then
+		if [ -s "/etc/snapper/configs/$snapper_config" ]; then
+			printf "# Info: snapper detected, using config '$snapper_config'\n" >&2
+			local snapper_ids=($(snapper --no-dbus -t 0 -c "$snapper_config" list --disable-used-space | tail -n +3 | cut -d'|' -f 1))
+			local snapper_types=($(snapper --no-dbus -t 0 -c "$snapper_config" list --disable-used-space | tail -n +3 | cut -d'|' -f 2))
 
-		IFS=$'\n'
-		local snapper_descriptions=($(snapper -t 0 -c "$snapper_config" list | tail -n +3 | rev | cut -d'|' -f 2 | rev))
+			IFS=$'\n'
+			local snapper_descriptions=($(snapper --no-dbus -t 0 -c "$snapper_config" list --disable-used-space | tail -n +3 | rev | cut -d'|' -f 2 | rev))
+		else
+			printf "# Warning: snapper detected but config '$snapper_config' does not exist\n" >&2
+		fi
 	fi
 
 	IFS=$'\n'
@@ -264,7 +283,7 @@ snapshot_list()
 		# ignore specific path during run "grub-mkconfig"
 		if [ ! -z "${ignore_specific_path}" ] ; then
 			for isp in ${ignore_specific_path[@]} ; do
-				[[ "${snap_path_name}" == "${isp}"/* ]] && continue 2;
+				[[ "${snap_path_name}" == "${isp}" || "${snap_path_name}" == "${isp}"/* ]] && continue 2;
 			done
 		fi
 
@@ -300,6 +319,10 @@ snapshot_list()
 		local entry="${entries[$i]}"
 		for j in "${!snapper_ids[@]}"; do
 			local snapper_id="${snapper_ids[$j]//[[:space:]]/}"
+			# remove other non numeric characters
+			snapper_id="${snapper_id//\*/}"
+			snapper_id="${snapper_id//\+/}"
+			snapper_id="${snapper_id//-/}"
 			if [[ "$snapper_id" == "$id" ]]; then
 				local snapper_type=$(trim "${snapper_types[$j]}")
 				local snapper_description=$(trim "${snapper_descriptions[$j]}")
@@ -519,11 +542,11 @@ check_uuid_required
 if [[ "$override_boot_partition_detection" == "true" ]]; then
 	printf "# Info: Override boot partition detection : enable \n" >&2 ;
 	boot_separate
-	else
+else
 	if [[ "$root_uuid" != "$boot_uuid" ]]; then
 		printf "# Info: Separate boot partition detected \n" >&2 ;
 		boot_separate
-		else
+	else
 		printf "# Info: Separate boot partition not detected \n" >&2 ;
 		boot_bounded
 	fi
@@ -544,8 +567,8 @@ fi
 root_grub="$(make_system_path_relative_to_its_root /boot/$grub_directory)"
 # Make a submenu in GRUB (grub.cfg)
 cat << EOF
-submenu '${submenuname}' {
-	configfile "${root_grub}/grub-btrfs.cfg"
+submenu '${submenuname}' ${protection_authorized_users}${unrestricted_access_submenu}{
+	configfile "\${prefix}/grub-btrfs.cfg"
 }
 EOF
 printf "###### - Grub-btrfs: Snapshot detection ended   - ######\n" >&2 ;

README.md

@@ -11,10 +11,16 @@ Improves Grub by adding "btrfs snapshots" to the Grub menu.
 
 You can start your system on a "snapshot" from the Grub menu.
 
-Supports manual snapshots, snapper ...
+Supports manual snapshots, snapper, timeshift ...
+
+##### Warning: booting on read-only snapshots can be tricky
+
+If you choose to do it, `/var/log` must be on a separate subvolume.
+
+Otherwise, make sure your snapshots are writeable.
+
+See [this ticket](https://github.com/Antynea/grub-btrfs/issues/92) for more info.
 
-##### Warning : it isn't recommended to start on read-only snapshot
-##
 ### What does grub-btrfs v4.xx do :
 * Automatically List snapshots existing on root partition (btrfs).
 * Automatically Detect if "/boot" is in separate partition.
@@ -34,7 +40,10 @@ pacman -S grub-btrfs
 
 * Run `make install` or look into Makefile for instructions on where to put each file.
 
-NOTE: Generate your Grub menu after installation for the changes to take effect. (on Arch Linux use `grub-mkconfig -o /boot/grub/grub.cfg`)
+NOTE: Generate your Grub menu after installation for the changes to take effect.
+
+On Arch Linux use `grub-mkconfig -o /boot/grub/grub.cfg`.
+
 ##
 ### Customization:
 
@@ -42,78 +51,111 @@ You have the possibility to modify many parameters in `/etc/default/grub-btrfs/c
 
 * GRUB_BTRFS_SUBMENUNAME="Arch Linux Snapshots"
 
-	(Name appearing in the Grub menu.)
+	Name appearing in the Grub menu. Use distribution information from /etc/os-release by default.
 
 * GRUB_BTRFS_PREFIXENTRY="Snapshot:"
 
-	(Add a name ahead your snapshots entries in the Grub menu.)
+	Add a name ahead your snapshots entries in the Grub menu.
 	
 * GRUB_BTRFS_DISPLAY_PATH_SNAPSHOT="true"
 	
-	(Show full path snapshot or only name in the Grub menu, weird reaction with snapper)
+	Show full path snapshot or only name in the Grub menu, weird reaction with snapper.
 	
 * GRUB_BTRFS_TITLE_FORMAT="p/d/n"
 
- 	(Custom title, shows/hides p"prefix" d"date" n"name" in the Grub menu, separator "/", custom order available)
+ 	Custom title, shows/hides p"prefix" d"date" n"name" in the Grub menu, separator "/", custom order available.
 
 * GRUB_BTRFS_LIMIT="50"
 
-	(Limit the number of snapshots populated in the GRUB menu.)
+	Limit the number of snapshots populated in the GRUB menu.
 
 * GRUB_BTRFS_SUBVOLUME_SORT="descending"
 
-	(Sort the found subvolumes by newest first ("descending") or oldest first ("ascending"). 
-	If "ascending" is chosen then the $GRUB_BTRFS_LIMIT oldest
-	subvolumes will populate the menu.)
+	Sort the found subvolumes by newest first ("descending") or oldest first ("ascending"). 
+	
+	If "ascending" is chosen then 
+	
+	the $GRUB_BTRFS_LIMIT oldest subvolumes will populate the menu.
 
 * GRUB_BTRFS_SHOW_SNAPSHOTS_FOUND="true"
 	
-	(Show snapshots found during run "grub-mkconfig") 
+	Show snapshots found during run "grub-mkconfig".
 	
 * GRUB_BTRFS_SHOW_TOTAL_SNAPSHOTS_FOUND="true"
 	
-	(Show Total number of snapshots found during run "grub-mkconfig")
+	Show Total number of snapshots found during run "grub-mkconfig".
 
 * GRUB_BTRFS_NKERNEL=("kernel-custom")
 
-	(Use it only if you have a custom kernel name)
+	Use it only if you have a custom kernel name
 
 * GRUB_BTRFS_NINIT=("initramfs-custom.img" "initrd.img-custom")
 
-	(Use it only if you have a custom initramfs name)
+	Use it only if you have a custom initramfs name.
 
 * GRUB_BTRFS_INTEL_UCODE=("intel-ucode.img")
 
-	(Use it only if you have custom intel-ucode)
+	Use it only if you have custom intel-ucode.
 
 * GRUB_BTRFS_IGNORE_SPECIFIC_PATH=("var/lib/docker")
 
-	(Ignore specific path during run "grub-mkconfig")
+	Ignore specific path during run "grub-mkconfig".
+	
+	For example: 
+	
+	If path is a directory `# Found Snapshot: 2016-03-31 10:24:41` **var/lib/docker/btrfs/subvolumes/...**
+	
+	use : `GRUB_BTRFS_IGNORE_SPECIFIC_PATH=("var/lib/docker")`
+	
+	If path is a subvolume : `# Found Snapshot: 2016-03-31 10:24:41` **@var/lib/docker/btrfs/subvolumes/...**
+	
+	use : `GRUB_BTRFS_IGNORE_SPECIFIC_PATH=("@var/lib/docker")`
+	
+	You can combine them
+	
+	use : `GRUB_BTRFS_IGNORE_SPECIFIC_PATH=("@var/lib/docker" "var/lib/docker")`
+
 
 * GRUB_BTRFS_SNAPPER_CONFIG="root"													
 
-	(Snapper's config name to use)
+	Snapper's config name to use.
 
 * GRUB_BTRFS_DISABLE="false"
 
-	(Disable grub-btrfs)
+	Disable grub-btrfs.
 
 * GRUB_BTRFS_DIRNAME="grub"
 
-	(Name of the grub folder in `/boot/`, might be grub2 on some distributions )
+	Name of the grub folder in `/boot/`, might be grub2 on some distributions.
 
 * GRUB_BTRFS_OVERRIDE_BOOT_PARTITION_DETECTION="false"
-	(Change to "true" if you have a boot partition in a different subvolume)
+
+	Change to "true" if you have a boot partition in a different subvolume.
 
 * GRUB_BTRFS_MKCONFIG=grub-mkconfig
 
-    (Name or path of the 'grub-mkconfig' executable; might be 'grub2-mkconfig' on some distributions)
+	Name or path of the 'grub-mkconfig' executable; might be 'grub2-mkconfig' on some distributions.
+	
+- Password protection management for submenu (refer to the [Grub documentation](https://www.gnu.org/software/grub/manual/grub/grub.html#Authentication-and-authorisation))
+
+	- GRUB_BTRFS_PROTECTION_AUTHORIZED_USERS=""
+
+		Add authorized usernames separate by comma (foo,bar)
+	
+		When Grub's password protection is enabled, the superuser is authorized by default, it isn't necessary to add it
+		
+	- GRUB_BTRFS_DISABLE_PROTECTION_SUBMENU="false"
+
+		Disable authentication support for submenu of Grub-btrfs only (--unrestricted)
+	
+		doesn't work if `GRUB_BTRFS_PROTECTION_AUTHORIZED_USERS` isn't empty
+
 ##
 ### Automatically update grub
-If you would like Grub to automatically update when a snapshots is made or deleted:
+If you would like Grub to automatically update when a snapshot is made or deleted:
 * Mount your subvolume which contains snapshots to `/.snapshots`
 * Use `systemctl start/enable grub-btrfs.path`
-* `grub-btrfs.path` automatically (re)generate `grub.cfg` when a modification appear in `/.snapshots`
+* `grub-btrfs.path` automatically (re)generates `grub.cfg` when a modification appears in `/.snapshots`
 ##
 ### Special thanks for assistance and contributions
 * [maximbaz](https://github.com/maximbaz)

config

@@ -1,19 +1,87 @@
 #!/usr/bin/env bash
 
-# GRUB_BTRFS_SUBMENUNAME="Arch Linux snapshots"                              # Name appearing in the Grub menu
-# GRUB_BTRFS_PREFIXENTRY="Snapshot:"                                         # Add a name ahead your snapshots entries in the Grub menu
-# GRUB_BTRFS_DISPLAY_PATH_SNAPSHOT="true"                                    # Show full path snapshot or only name in the Grub menu
-# GRUB_BTRFS_TITLE_FORMAT="p/d/n"                                            # Custom title, shows/hides p"prefix" d"date" n"name" in the Grub menu, separator "/", custom order available
-# GRUB_BTRFS_LIMIT="50"                                                      # Limit the number of snapshots populated in the GRUB menu
-# GRUB_BTRFS_SUBVOLUME_SORT="descending"                                     # Sort the found subvolumes by newest first ("descending") or oldest first ("ascending") and show $GRUB_BTRFS_LIMIT first entries.
-# GRUB_BTRFS_SHOW_SNAPSHOTS_FOUND="true"                                     # Show snapshots found during run "grub-mkconfig"
-# GRUB_BTRFS_SHOW_TOTAL_SNAPSHOTS_FOUND="true"                               # Show Total of snapshots found during run "grub-mkconfig"
-# GRUB_BTRFS_NKERNEL=("vmlinuz-linux")                                       # Use only if you have custom kernel name
-# GRUB_BTRFS_NINIT=("initramfs-linux.img" "initramfs-linux-fallback.img")    # Use only if you have custom initramfs name
-# GRUB_BTRFS_INTEL_UCODE=("intel-ucode.img")                                 # Use only if you have custom intel-ucode
-# GRUB_BTRFS_IGNORE_SPECIFIC_PATH=("var/lib/docker")                         # Ignore specific path during run "grub-mkconfig"
-# GRUB_BTRFS_SNAPPER_CONFIG="root"                                           # Snapper's config name to use
-# GRUB_BTRFS_DISABLE="false"                                                 # Disable Grub-btrfs
-# GRUB_BTRFS_DIRNAME=grub                                                    # Might be grub2 on some systems ex. /boot/grub2/...
-# GRUB_BTRFS_OVERRIDE_BOOT_PARTITION_DETECTION="false"                       # Change to "true" if you have a boot partition in a different subvolume
-# GRUB_BTRFS_MKCONFIG=grub-mkconfig                                          # Might be 'grub2-mkconfig' on some systems
+# Name appearing in the Grub menu
+# Default: Use distribution information from /etc/os-release
+#GRUB_BTRFS_SUBMENUNAME="Arch Linux snapshots"
+
+# Add a name ahead your snapshots entries in the Grub menu
+# Default: "Snapshot:"
+#GRUB_BTRFS_PREFIXENTRY="Snapshot:"
+
+# Show full path snapshot or only name in the Grub menu
+# Default: "true"
+#GRUB_BTRFS_DISPLAY_PATH_SNAPSHOT="true"
+
+# Custom title
+# shows/hides p"prefix" d"date" n"name" in the Grub menu, separator "/", custom order available
+# Default: "p/d/n"
+#GRUB_BTRFS_TITLE_FORMAT="p/d/n"
+
+# Limit the number of snapshots populated in the GRUB menu
+# Default: "50"
+#GRUB_BTRFS_LIMIT="50"
+
+# Sort the found subvolumes by newest first ("descending") or oldest first ("ascending") and show $GRUB_BTRFS_LIMIT first entries.
+# Default: "descending"
+#GRUB_BTRFS_SUBVOLUME_SORT="descending"
+
+# Show snapshots found during run "grub-mkconfig"
+# Default: "true"
+#GRUB_BTRFS_SHOW_SNAPSHOTS_FOUND="true"
+
+# Show Total of snapshots found during run "grub-mkconfig"
+# Default: "true"
+#GRUB_BTRFS_SHOW_TOTAL_SNAPSHOTS_FOUND="true"
+
+# Use only if you have custom kernel name
+# Default:
+#GRUB_BTRFS_NKERNEL=("vmlinuz-linux")
+
+# Use only if you have custom initramfs name
+# Default:
+#GRUB_BTRFS_NINIT=("initramfs-linux.img" "initramfs-linux-fallback.img")
+
+# Use only if you have custom intel-ucode
+# Default:
+#GRUB_BTRFS_INTEL_UCODE=("intel-ucode.img")
+
+# Ignore specific path during run "grub-mkconfig".
+# If path is a directory, # Found Snapshot: 2016-03-31 10:24:41 var/lib/docker/btrfs/subvolumes/...
+# use : GRUB_BTRFS_IGNORE_SPECIFIC_PATH=("var/lib/docker");
+# If path is a subvolume, # Found Snapshot: 2016-03-31 10:24:41 @var/lib/docker/btrfs/subvolumes/...
+# use : GRUB_BTRFS_IGNORE_SPECIFIC_PATH=("@var/lib/docker");
+# You can combine them
+# use : GRUB_BTRFS_IGNORE_SPECIFIC_PATH=("@var/lib/docker" "var/lib/docker")
+# Default: 
+GRUB_BTRFS_IGNORE_SPECIFIC_PATH=("@" "var/lib/docker" "@var/lib/docker")
+
+# Snapper's config name to use
+# Default: "root"
+#GRUB_BTRFS_SNAPPER_CONFIG="root"
+
+# Disable Grub-btrfs
+# Default: "false"
+#GRUB_BTRFS_DISABLE="false"
+
+# Change to "true" if you have a boot partition in a different subvolume
+# Default: "false"
+#GRUB_BTRFS_OVERRIDE_BOOT_PARTITION_DETECTION="false"
+
+# Might be grub2 on some systems ex. /boot/grub2/...
+# Default: "grub"
+#GRUB_BTRFS_DIRNAME="grub"
+
+# Might be 'grub2-mkconfig' on some systems
+# Default: /usr/bin/grub-mkconfig
+#GRUB_BTRFS_MKCONFIG=/usr/bin/grub2-mkconfig
+
+## Password protection management for submenu,snapshots
+# Add authorized usernames separate by comma (foo,bar)
+# When Grub's password protection is enabled, the superuser is authorized by default, it isn't necessary to add it
+# Default:
+# GRUB_BTRFS_PROTECTION_AUTHORIZED_USERS=""
+#
+# Disable authentication support for submenu of Grub-btrfs only (--unrestricted)
+# doesn't work if GRUB_BTRFS_PROTECTION_AUTHORIZED_USERS isn't empty
+# Default: false
+# GRUB_BTRFS_DISABLE_PROTECTION_SUBMENU="false"