Index: b/util/grub-mkconfig.in
===================================================================
--- a/util/grub-mkconfig.in
+++ b/util/grub-mkconfig.in
@@ -293,6 +293,10 @@
   esac
 done
 
+if [ "x${grub_cfg}" != "x" ] && ! grep "^password " ${grub_cfg}.new >/dev/null; then
+  chmod 444 ${grub_cfg}.new || true
+fi
+
 if test "x${grub_cfg}" != "x" ; then
   if ! ${grub_script_check} ${grub_cfg}.new; then
     echo "Syntax errors are detected in generated GRUB config file." >&2