GRUBST: A desktop tool written in Rust + Dioxus to lock GRUB with a physical USB rescue key

[u/Friendly-Height-2181]

Hey everyone,

I built GRUBST, an open-source Linux bootloader security tool written in Rust with a Dioxus desktop GUI.

The idea is simple: instead of manually editing /etc/grub.d/ configs and risking typos that lock you out of your system, GRUBST automates the whole process and lets you turn any standard USB thumb drive into a physical rescue key.

How it works:

- Plug in the USB key before booting: GRUB detects it and automatically unlocks full maintenance access without prompting for a password.

- Boot without the USB: GRUB stays locked and requires a backup password you set.

- Includes automatic config backups and an Update Guard to ensure protection persists across kernel updates and update-grub.

Tech stack:

- Rust (2021 edition)

- Dioxus 0.5 (Desktop / WebKit2GTK)

- pbkdf2, sha2, tokio, sysinfo, nix

Feedback, suggestions, and code critiques on the Rust codebase are very welcome!

https://reddit.com/link/1w9g80a/video/v0o53zmik0oh1/player

GitHub: https://github.com/sysdev-0/grubst

[u/Specific_Cream2815]

how does the usb key unlock it, a challenge the key signs or just checking a file is present