Repository :
http://git.fedorahosted.org/git/?p=docs/uefi-secure-boot-guide.git
On branch : master
---------------------------------------------------------------
commit d9fe09fbc5c3a5b7da6dd3f4eb12ebc7f371617d
Author: Eric Christensen <sparks(a)fedoraproject.org>
Date: Fri Feb 1 17:06:42 2013 -0500
Fixed 'grub's and rewrote the scope sentence again
---------------------------------------------------------------
en-US/What_is_Secure_Boot.xml | 5 ++---
1 files changed, 2 insertions(+), 3 deletions(-)
diff --git a/en-US/What_is_Secure_Boot.xml b/en-US/What_is_Secure_Boot.xml
index 95de533..9b720c3 100644
--- a/en-US/What_is_Secure_Boot.xml
+++ b/en-US/What_is_Secure_Boot.xml
@@ -12,7 +12,7 @@
Earlier versions of &PRODUCT; booted on such hardware will refuse to boot until the
user disables Secure Boot in the firmware. While disabling Secure Boot is a viable option
that some users may wish to choose, it is not an optimal solution.
</para>
<para>
- To facilitate out of the box functionality on new hardware, the maintainers of the
grub2, kernel and associated packages have implemented Secure Boot support in
&PRODUCT;. On UEFI machines, &PRODUCT; uses a small bootloader called
"shim" that has been signed by the Microsoft signing service (via Verisign).
This allows UEFI to load shim on Windows 8 client ready machines and continue the boot
process for Linux. Shim in turn boots grub2, which is signed by a &PRODUCT; key.
Grub2 then boots a similarly signed Linux kernel provided by &PRODUCT; which loads the
rest of the OS as per the usual boot process. The machine remains in Secure Boot mode.
+ To facilitate out of the box functionality on new hardware, the maintainers of the GRUB,
kernel and associated packages have implemented Secure Boot support in &PRODUCT;. On
UEFI machines, &PRODUCT; uses a small bootloader called "shim" that has been
signed by the Microsoft signing service (via Verisign). This allows UEFI to load shim on
Windows 8 client ready machines and continue the boot process for Linux. Shim in turn
boots GRUB, which is signed by a &PRODUCT; key. GRUB then boots a similarly signed
Linux kernel provided by &PRODUCT; which loads the rest of the OS as per the usual
boot process. The machine remains in Secure Boot mode.
</para>
<section
id="sect-UEFI_Secure_Boot_Guide-What_is_Secure_Boot-Protect_you_from">
<title>What does Secure Boot protect you from?</title>
@@ -21,8 +21,7 @@
a system. The goal is to prevent untrusted code from booting the system,
once that part has been verified, it's up to the operating system to take
over protection. This does give the potential for the operating system to
-extend this chain of trust down into user binaries, but that moves us
-outside of the concept of Secure Boot and into another topic.
+extend this chain of trust down into user binaries, but that is beyond the scope of this
document.
</para>
<para>
&PRODUCT; has expanded the chain of trust into the kernel.