table of contents
| VIRT-FW-VARS(1) | User Commands | VIRT-FW-VARS(1) |
NAME¶
virt-fw-vars - manual page for virt-fw-vars 25.7.3
DESCRIPTION¶
The virt-fw-vars utility can print and modify UEFI variable stores. Supported formats are standard edk2 (as used by ovmf and armvirt) and aws.
usage: virt-fw-vars [-h] [-l LEVEL] [-i FILE] [--inplace FILE]
- [--extract-certs] [-d VAR] [--set-true VAR]
- [--set-false VAR] [--set-json FILE] [--set-boot-uri LINK] [--append-boot-filepath FILE] [--set-shim-debug] [--set-shim-verbose] [--set-fallback-verbose] [--set-fallback-no-reboot] [--set-sbat-level FILE] [--set-pk GUID FILE] [--add-kek GUID FILE] [--add-db GUID FILE] [--add-db-hash GUID HASH] [--set-dbx FILE] [--add-dbx FILE] [--add-dbx-cert GUID FILE] [--add-dbx-hash GUID HASH] [--add-mok GUID FILE] [--add-mok-hash GUID HASH] [--enroll-redhat] [--enroll-cert CERT] [--enroll-generate CN] [--enroll-mgmt] [--no-microsoft] [--microsoft-kek {none,2011,2023,all}] [--distro-keys DISTRO] [--distro-list] [--sb] [-p] [-v] [--hashes] [-x] [-o FILE] [--output-aws FILE] [--output-json FILE] [--output-auth DIR]
Print and modify EFI variable stores.
options:¶
- -h, --help
- show this help message and exit
- -l, --loglevel LEVEL
- set loglevel to LEVEL
- -i, --input FILE
- read edk2 or aws vars from FILE
- --inplace, --in-place FILE
- modify FILE in place
- --extract-certs
- extract all certificates
Variable options:¶
- -d, --delete VAR
- delete variable VAR, can be specified multiple times
- --set-true VAR
- set variable VAR to true, can be specified multiple times
- --set-false VAR
- set variable VAR to false, can be specified multiple times
- --set-json FILE
- set variables from json dump FILE
Boot configuration:¶
- --set-boot-uri LINK
- set network boot uri to LINK (once, using BootNext)
- --append-boot-filepath FILE
- append boot entry for FILE (permanent, using BootOrder)
shim.efi configuration:¶
- --set-shim-debug
- enable shim.efi debugging (pause for debugger attach)
- --set-shim-verbose
- enable shim.efi verbose messages
- --set-fallback-verbose
- enable fallback.efi verbose messages
- --set-fallback-no-reboot
- disable rebooting for fallback.efi
- --set-sbat-level FILE
- set SbatLevel variable
Secure boot setup options:¶
- --set-pk, --set-pk-cert GUID FILE
- set PK to x509 cert, loaded in pem or der format from FILE and with owner GUID
- --add-kek, --add-kek-cert GUID FILE
- add x509 cert to KEK, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
- --add-db, --add-db-cert GUID FILE
- add x509 cert to db, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
- --add-db-hash GUID HASH
- add sha256 HASH to db, with owner GUID, can be specified multiple times
- --set-dbx FILE
- initialize dbx with update from FILE
- --add-dbx FILE
- append dbx update from FILE
- --add-dbx-cert GUID FILE
- add x509 cert to dbx, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
- --add-dbx-hash GUID HASH
- add sha256 HASH to dbx, with owner GUID, can be specified multiple times
- --add-mok, --add-mok-cert GUID FILE
- add x509 cert to MokList, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
- --add-mok-hash GUID HASH
- add sha256 HASH to MokList, with owner GUID, can be specified multiple times
Secure boot convinience shortcuts:¶
- --enroll-redhat
- enroll default certificates for redhat platform
- --enroll-cert CERT
- enroll using specified certificate
- --enroll-generate CN
- enroll using generated cert with given common name
- --enroll-mgmt
- enroll using external management guid
- --no-microsoft
- do not add microsoft keys to db
- --microsoft-kek {none,2011,2023,all}
- choose microsoft KEK keys to enroll
- --distro-keys DISTRO
- add ca keys for DISTRO
- --distro-list
- list known distros
- --sb, --secure-boot
- enable secure boot mode
Print options:¶
- -p, --print
- print varstore
- -v, --verbose
- print varstore verbosely
- --hashes
- print signature db sha256 hashes
- -x, --hexdump
- print variable hexdumps
Output options:¶
- -o, --output FILE
- write edk2 or aws vars to FILE, using the same format the --input FILE has.
- --output-aws FILE
- write aws vars to FILE
- --output-json FILE
- write json dump to FILE
- --output-auth DIR
- write *.auth files to DIR
EXAMPLES¶
- Print variable store.
- virt-fw-vars --input ${guest}_VARS.fd \
--print --verbose - Enroll default (microsoft) secure boot certificates
- virt-fw-vars --input OVMF_VARS.fd \
--output OVMF_VARS.secboot.fd \
--enroll-redhat \
--secure-boot
AUTHOR¶
Gerd Hoffmann <kraxel@redhat.com>
| July 2025 | virt-fw-vars 25.7.3 |