Fedora CoreOS supports setting a GRUB bootloader password using a Butane config

Fedora CoreOS supports setting a GRUB bootloader password

using a Butane config. When this feature is enabled, GRUB requires a password to access the

GRUB command-line, modify kernel command-line arguments, or boot

non-default OSTree deployments. Recent Fedora CoreOS releases have a

misconfiguration which allows booting non-default OSTree deployments

without entering a password. This allows someone with access to the

GRUB menu to boot into an older version of Fedora CoreOS, reverting

any security fixes that have recently been applied to the machine. A

password is still required to modify kernel command-line arguments and

to access the GRUB command line.