Ensure GRUB uses a unique superusers name

# Check for GRUB superusers setting
superuser=""
for f in /boot/grub2/grub.cfg /boot/efi/EFI/redhat/grub.cfg; do
  if [ -f "$f" ]; then
    superuser=$(grep -E '^\s*set\s+superusers=' "$f" 2>/dev/null | sed 's/.*superusers="\{0,1\}\([^"]*\)"\{0,1\}/\1/' | head -1)
    break
  fi
done
if [ -z "$superuser" ]; then
  echo "FAIL: No superusers directive found in GRUB config"
  exit 1
fi
for bad in root admin superuser unlock; do
  if [ "$superuser" = "$bad" ]; then
    echo "FAIL: GRUB superusers name is default/predictable: $superuser"
    exit 1
  fi
done
echo "OK: GRUB superusers name is unique: $superuser"
exit 0

expected_exit:

0

note:

Configure a unique GRUB superuser name: grub2-setpassword. Edit /etc/grub.d/01_users to set a unique superusers name, then regenerate grub.cfg.