In the past, the GRUB menu has been open to anyone who has physical access to the console. Changes in the Oracle Solaris 11.3 release, have added the ability to lock the GRUB menu so that no one can see it without entering a password.
You can control access to the whole GRUB menu by setting a password lock. Any user who has access to the console and knows the password will be able to view entries in the GRUB menu. The options to the bootadm set-menu-password command that manage the password lock are:
Sets a password needed to view, edit, or boot any entry in the GRUB menu
Removes the password needed to access the GRUB menu
Lists whether a password lock is in place and which users have access to each menu entry
In addition, you can give individual users the ability to view, edit, or boot all entries in the GRUB menu, or specify entries accessible for each user. For more information, see Granting Users Authorizations to Access the GRUB Menu.
Caution - If you place a password lock on the whole GRUB menu, someone must enter the password before the system will boot.