dasharo/edk2
0
0
Fork 0
mirror of https://github.com/Dasharo/edk2.git synced 2026-06-13 10:16:24 -07:00
Code Issues Packages Projects Releases Wiki Activity

[Staging/Customized-Secure-Boot]: Update ReadMe.MD to clarify feature

Browse Source 
Update ReadMe.MD to clarify AuditMode/DeployedMode feature. Fix one typo and replace Mantis link
with UEFI2.6 spec link.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
This commit is contained in:
Zhang, Chao B
2016-04-26 10:09:23 +08:00
parent b002e8b293
commit f23093da0d
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Readme.MD
+10 -2
View File
@@ -19,11 +19,19 @@
Chao Zhang <chao.b.zhang@intel.com>
3. Feature Summary
Customized Secure Boto feature provides capabilities for automated platform deployment by enterprises, OEMs, system integrators, and
Customized Secure Boot feature provides capabilities for automated platform deployment by enterprises, OEMs, system integrators, and
enthusiasts into custom, higher security Secure Boot configurations. This can mitigate chain of custody concerns in the supply chain
of a given hardware platform. It further provides the ability to manage multiple UEFI certificate signers and image revocations from
multiple signers. It also provides a viable solution to enterprise, enthusiast, and OS vendor signing of images while maintaining overall
security of the pre-boot environment. Finally, it provides for a consistent programmatic and secure re-deployment of already-deployed systems.
To achieve customized and high assurance deployments, this proposal introduces two new modes to the UEFI Secure Boot design, Audit Mode and
Deployed Mode, and corresponding variables to control their state, "AuditMode" and "DeployedMode".
Audit Mode:
Audit Mode enables programmatic discovery of signature list combinations that successfully authenticate installed EFI images without the risk
of rendering a system unbootable.
Deployed Mode:
Deployed Mode is the most secure mode. It is the recommended mode for systems after the Secure Boot configuration has been selected, configured,
and tested.
4. Timeline
N/A
@@ -39,7 +47,7 @@
SecureBootConfigDxe
6. Related Links
https://mantis.uefi.org/mantis/view.php?id=1263
http://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf
7. Misc
N/A