tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: Correct chainloader UEFI secure boot info

Browse Source 
Correct documentation for UEFI secure boot to remove statement that
chainloader does not work with secure boot. This was fixed by the commit
6d05264 (kern/efi/sb: Add chainloaded image as shim's verifiable object).

Fixes: https://savannah.gnu.org/bugs/?62004

Signed-off-by: Andrew Hamilton <adhamilt@gmail.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Andrew Hamilton 2024-10-30 19:24:53 -05:00 committed by Daniel Kiper
parent f48e6af117
commit 097fd9d9a1
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
docs/grub.texi
View File

@ -8678,13 +8678,13 @@ secure boot chain.
@node UEFI secure boot and shim
@section UEFI secure boot and shim support
The GRUB, except the @command{chainloader} command, works with the UEFI secure
boot and the shim. This functionality is provided by the shim_lock verifier. It
is built into the @file{core.img} and is registered if the UEFI secure boot is
enabled. The @samp{shim_lock} variable is set to @samp{y} when shim_lock verifier
is registered. If it is desired to use UEFI secure boot without shim, one can
disable shim_lock by disabling shim verification with MokSbState UEFI variable
or by building grub image with @samp{--disable-shim-lock} option.
The GRUB works with UEFI secure boot and the shim. This functionality is
provided by the shim_lock verifier. It is built into the @file{core.img} and is
registered if the UEFI secure boot is enabled. The @samp{shim_lock} variable is
set to @samp{y} when shim_lock verifier is registered. If it is desired to use
UEFI secure boot without shim, one can disable shim_lock by disabling shim
verification with MokSbState UEFI variable or by building grub image with
@samp{--disable-shim-lock} option.
All GRUB modules not stored in the @file{core.img}, OS kernels, ACPI tables,
Device Trees, etc. have to be signed, e.g, using PGP. Additionally, the commands