Protect the grub boot menu.

roles/lmn_kde/tasks/main.yml

@@ -155,7 +155,15 @@
   command: sync-vm.sh -t
   ## FIXME: do not run every time
 
-################# from kiosk.yml ##################
+################# general settings ##################
+- name: Protect grub menu entries
+  blockinfile:
+    path: /etc/grub.d/40_custom
+    block: |
+      set superusers='root'
+      password_pbkdf2 root {{ grub_pwd }}
+  notify: update grub
+
 - name: grub timeout
   lineinfile:
     dest: /etc/default/grub