<!--
SPDX-FileCopyrightText: fwupd Development Team

SPDX-License-Identifier: LGPL-2.1-or-later
-->

<!DOCTYPE html>
<html lang="en">
<head>
  <title>FwupdPlugin &ndash; 1.0: Configuration File Format</title>
  <meta name="viewport" content="width=device-width, initial-scale=1">

  <meta charset="utf-8" />

  
  <meta property="og:type" content="website"/>

  
  <meta property="og:image:width" content="256"/>
  <meta property="og:image:height" content="256"/>
  <meta property="og:image:secure_url" content="org.freedesktop.fwupd.svg"/>
  <meta property="og:image:alt" content="FwupdPlugin-1.0"/>
  

  
  <meta property="og:title" content="FwupdPlugin: Configuration File Format"/>
  <meta property="og:description" content="Reference for FwupdPlugin-1.0: Configuration File Format"/>
  <meta name="twitter:title" content="FwupdPlugin: Configuration File Format"/>
  <meta name="twitter:description" content="Reference for FwupdPlugin-1.0: Configuration File Format"/>


  
  <meta name="twitter:card" content="summary"/>

  
  
  
  

  <link rel="stylesheet" href="style.css" type="text/css" />

  

  
  <script src="urlmap_fwupdplugin.js"></script>
  
  
  <script src="fzy.js"></script>
  <script src="search.js"></script>
  
  <script src="main.js"></script>
</head>

<body>
  <div id="body-wrapper" tabindex="-1">

    <nav class="sidebar devhelp-hidden">
      
      <div class="section">
        <img src="org.freedesktop.fwupd.svg" class="logo"/>
      </div>
      
      
      <div class="search section">
        <form id="search-form" autocomplete="off">
          <input id="search-input" type="text" name="do-not-autocomplete" placeholder="Click, or press 's' to search" autocomplete="off"/>
        </form>
      </div>
      
      <div class="section namespace">
        <h3><a href="index.html">FwupdPlugin</a></h3>
        <p>API Version: 1.0</p>
        
        <p>Library Version: 1.9.1</p>
        
      </div>
      
      
      <div class="section generator">
        <p>Generated by <a href="https://gitlab.gnome.org/GNOME/gi-docgen">gi-docgen</a> 2023.1</p>
      </div>
    </nav>

    <button id="btn-to-top" class="hidden"><span class="up-arrow"></span></button>

    
<section id="main" class="content">
  <section>
    <div class="docblock">
    <p>% fwupd.conf(5) {{PACKAGE_VERSION}} | Configuration File&nbsp;Format</p>
<h2 id="name">NAME<a class="md-anchor" href="#name" title="Permanent link"></a></h2>
<p><strong>fwupd.conf</strong> — configuration file for the fwupd&nbsp;daemon.</p>
<h2 id="synopsis">SYNOPSIS<a class="md-anchor" href="#synopsis" title="Permanent link"></a></h2>
<p>The <code>{{SYSCONFDIR}}/fwupd/fwupd.conf</code> file is the main configuration file for the fwupd daemon.
The complete description of the file format and possible parameters are documented here for reference&nbsp;purposes.</p>
<h2 id="file-format">FILE FORMAT<a class="md-anchor" href="#file-format" title="Permanent link"></a></h2>
<p>The file consists of a multiple sections with optional parameters. Parameters are of the&nbsp;form:</p>
<p>[section]
  key =&nbsp;value</p>
<p>The file is line-based, each newline-terminated line represents either a comment, a section name or
a&nbsp;parameter.</p>
<p>Section and parameter names are case&nbsp;sensitive.</p>
<p>Only the first equals sign in a parameter is significant.
Whitespace before or after the first equals sign is discarded as is leading and trailing whitespace
in a parameter value.
Internal whitespace within a parameter value is&nbsp;retained.</p>
<p>Any line beginning with a hash (<code>#</code>) character is ignored, as are lines containing only&nbsp;whitespace.</p>
<p>The values following the equals sign in parameters are all either a string (no quotes needed),
unsigned integers, or a boolean, which may be given as <strong>true</strong> or <strong>false</strong>.
Case is not significant in boolean values, but is preserved in string&nbsp;values.</p>
<h2 id="daemon-parameters">DAEMON PARAMETERS<a class="md-anchor" href="#daemon-parameters" title="Permanent link"></a></h2>
<p>The <code>[daemon]</code> section can contain the following&nbsp;parameters:</p>
<p><strong>DisabledDevices=</strong></p>
<p>Allow blocking specific devices by their <span class="caps">GUID</span>, using semicolons as&nbsp;delimiter.</p>
<p><strong>DisabledPlugins={{FU_DAEMON_CONFIG_DEFAULT_DISABLED_PLUGINS}}</strong></p>
<p>Allow blocking specific plugins by name.
  Use <strong>fwupdmgr get-plugins</strong> to get the list of&nbsp;plugins.</p>
<p><strong>ArchiveSizeMax=</strong></p>
<p>Maximum archive size that can be loaded in Mb, with 25% of the total system memory as the&nbsp;default.</p>
<p><strong>IdleTimeout=</strong></p>
<p>Idle time in seconds to shut down the daemon, where a value of <strong>0</strong> specifies&nbsp;&#8220;never&#8221;.</p>
<p><strong><span class="caps">NOTE</span>:</strong> some plugins might inhibit the auto-shutdown, for instance&nbsp;thunderbolt.</p>
<p><strong>VerboseDomains=</strong></p>
<p>Comma separated list of domains to log in verbose mode.
  If unset, no domains are set to verbose.
  If set to &#8220;<em>&#8220;, all domains are verbose, which is the same as running the daemon with </em><em>&#8212;verbose &#8212;verbose</em>*.</p>
<p><strong>UpdateMotd={{FU_DAEMON_CONFIG_DEFAULT_UPDATE_MOTD}}</strong></p>
<p>Update the message of the day (<span class="caps">MOTD</span>) on device and metadata&nbsp;changes.</p>
<p><strong>EnumerateAllDevices={{FU_DAEMON_CONFIG_DEFAULT_ENUMERATE_ALL_DEVICES}}</strong></p>
<p>For some plugins, enumerate only devices supported by&nbsp;metadata.</p>
<p><strong>ApprovedFirmware=</strong></p>
<p>A list of firmware checksums that has been approved by the site admin
  If unset, all firmware is&nbsp;approved.</p>
<p><strong>BlockedFirmware=</strong></p>
<p>Allow blocking specific devices by their cabinet checksum, either <span class="caps">SHA</span>-1 or <span class="caps">SHA</span>-256.</p>
<p><strong>UriSchemes={{FU_DAEMON_CONFIG_DEFAULT_URI_SCHEMES}}</strong></p>
<p>Allowed <span class="caps">URI</span> schemes in the preference order; failed downloads from the first scheme will be retried with the next in order until no choices&nbsp;remain.</p>
<p><strong>IgnorePower={{FU_DAEMON_CONFIG_DEFAULT_IGNORE_POWER}}</strong></p>
<p>Ignore power levels of devices when running&nbsp;updates.</p>
<p><strong>OnlyTrusted={{FU_DAEMON_CONFIG_DEFAULT_ONLY_TRUSTED}}</strong></p>
<p>Only support installing firmware signed with a trusted key.
  Do not set this to <code>false</code> on a production or trusted&nbsp;system.</p>
<p><strong>ShowDevicePrivate={{FU_DAEMON_CONFIG_DEFAULT_SHOW_DEVICE_PRIVATE}}</strong></p>
<p>Show data such as device serial numbers which some users may consider&nbsp;private.</p>
<p><strong>AllowEmulation={{FU_DAEMON_CONFIG_DEFAULT_ALLOW_EMULATION}}</strong></p>
<p>Allow capturing and loading device emulation by logging all <span class="caps">USB</span> transfers.
  Enabling this will greatly increase the amount of memory fwupd uses when upgrading&nbsp;devices.</p>
<p><strong>TrustedUids={{FU_DAEMON_CONFIG_DEFAULT_TRUSTED_UIDS}}</strong></p>
<p>UIDs matching these values that call the D-Bus interface should marked as&nbsp;trusted.</p>
<p><strong>HostBkc={{FU_DAEMON_CONFIG_DEFAULT_HOST_BKC}}</strong></p>
<p>A host best known configuration is used when using <code>fwupdmgr sync</code> which can downgrade firmware to factory versions or upgrade firmware to a supported config level. e.g. <strong>vendor-factory-2021q1</strong></p>
<p><strong>ReleaseDedupe={{FU_DAEMON_CONFIG_DEFAULT_RELEASE_DEDUPE}}</strong></p>
<p>Deduplicate duplicate releases by the archive checksum are available from more than one&nbsp;source.</p>
<p><strong>ReleasePriority={{FU_DAEMON_CONFIG_DEFAULT_RELEASE_PRIORITY}}</strong></p>
<p>When the same version release is available from more than one source this option can be used to
  either prefer the local version (avoiding a potentially expensive download) or to prefer the
  remote version (which may have updated metadata such as release&nbsp;notes).</p>
<p>The possible options are <code>local</code> or <code>remote</code> or empty to not make any adjustment to the policy,
  relying on the <code>OrderAfter</code> and <code>OrderBefore</code> sections in the&nbsp;remote.</p>
<p><strong>EspLocation=</strong></p>
<p>Override the location used for the <span class="caps">EFI</span> system partition (<span class="caps">ESP</span>) path.
  This is typically used if UDisks is not available, or was not able to automatically identify the location for any&nbsp;reason.</p>
<p><strong>Manufacturer=</strong></p>
<p><strong>ProductName=</strong></p>
<p><strong>ProductSku=</strong></p>
<p><strong>Family=</strong></p>
<p><strong>EnclosureKind=</strong></p>
<p><strong>BaseboardProduct=</strong></p>
<p><strong>BaseboardManufacturer=</strong></p>
<p>Override values for <span class="caps">SMBIOS</span> or Device Tree data on the local system.
  These are only required when the <span class="caps">SMBIOS</span> or Device Tree data is invalid, missing, or to simulate running on another system.
  Empty values should be used to populate blank entries or add values to populate specific&nbsp;entries.</p>
<p><strong>TrustedReports={{FU_DAEMON_CONFIG_DEFAULT_TRUSTED_REPORTS}}</strong></p>
<p>Vendor reports matching these expressions will have releases marked as <code>trusted-report</code>,&nbsp;e.g.</p>
<ul>
<li>
<p><code>DistroId=chromeos</code></p>
</li>
<li>
<p><code>DistroId=fedora&amp;VendorId=19</code></p>
</li>
<li>
<p><code>DistroId=fedora&amp;VendorId=$OEM</code></p>
</li>
<li>
<p><code>DistroId=fedora;DistroId=rhel&amp;DistroVersion=9</code></p>
</li>
</ul>
<p><span class="caps">NOTE</span>: a <code>VendorId</code> of <code>$OEM</code> represents the <span class="caps">OEM</span> vendor <span class="caps">ID</span> of the vendor that owns the firmware,
  for example, where Lenovo <span class="caps">QA</span> has generated a signed report for a Lenovo&nbsp;laptop.</p>
<p>There are also three os-release values available, <code>$ID</code>, <code>$VERSION_ID</code> and <code>$VARIANT_ID</code>, which
  allow expressions&nbsp;like:</p>
<ul>
<li>
<p><code>DistroId=$ID</code></p>
</li>
<li>
<p><code>DistroId=$ID,DistroVersion=$VERSION_ID</code></p>
</li>
</ul>
<p>{% if plugin_uefi_capsule %}
UEFI_CAPSULE <span class="caps">PARAMETERS</span></p>
<hr />
<p>The <code>[uefi_capsule]</code> section can contain the following&nbsp;parameters:</p>
<p><strong>EnableGrubChainLoad={{FU_UEFI_CAPSULE_CONFIG_DEFAULT_ENABLE_GRUB_CHAIN_LOAD}}</strong></p>
<p>Configure <span class="caps">GRUB</span> to launch <code>fwupdx64.efi</code> instead of using other methods such as <span class="caps">NVRAM</span> or&nbsp;Capsule-On-Disk.</p>
<p><strong>DisableShimForSecureBoot={{FU_UEFI_CAPSULE_CONFIG_DEFAULT_DISABLE_SHIM_FOR_SECURE_BOOT}}</strong></p>
<p>The shim loader is required to chainload the fwupd <span class="caps">EFI</span> binary unless the <code>fwupd.efi</code> file has been self-signed&nbsp;manually.</p>
<p><strong>RequireESPFreeSpace={{FU_UEFI_CAPSULE_CONFIG_DEFAULT_REQUIRE_ESP_FREE_SPACE}}</strong></p>
<p>Amount of free space required on the <span class="caps">ESP</span>, for example using <code>32</code> for 32Mb.
  By default this is dynamically set to at least twice the size of the&nbsp;payload.</p>
<p><strong>DisableCapsuleUpdateOnDisk={{FU_UEFI_CAPSULE_CONFIG_DEFAULT_DISABLE_CAPSULE_UPDATE_ON_DISK}}</strong></p>
<p>Allow ignoring the CapsuleOnDisk support advertised by the&nbsp;firmware.</p>
<p><strong>EnableEfiDebugging={{FU_UEFI_CAPSULE_CONFIG_DEFAULT_ENABLE_EFI_DEBUGGING}}</strong></p>
<p>Enable the low-level debugging of <code>fwupdx64.efi</code> to the <code>FWUPDATE_DEBUG_LOG</code> <span class="caps">EFI</span>&nbsp;variable.</p>
<p><strong><span class="caps">NOTE</span>:</strong> enabling this option is going to fill up the <span class="caps">NVRAM</span> store much more quickly and
  should only be enabled when debugging an issue with the <span class="caps">EFI</span>&nbsp;binary.</p>
<p>This value also has no affect when using Capsule-on-Disk as the <span class="caps">EFI</span> helper binary is
  not being used.
{% endif&nbsp;%}</p>
<p>{% if plugin_msr %}
<span class="caps">MSR</span> <span class="caps">PARAMETERS</span></p>
<hr />
<p>The <code>[msr]</code> section can contain the following&nbsp;parameter:</p>
<p><strong>MinimumSmeKernelVersion={{FU_MSR_CONFIG_DEFAULT_MINIMUM_SME_KERNEL_VERSION}}</strong></p>
<p>Minimum kernel version to allow probing for sme&nbsp;flag.</p>
<p>This only needs to be modified by enterprise kernels that have cherry picked the feature into a
  kernel with an old version number.
{% endif&nbsp;%}</p>
<p>{% if plugin_redfish %}
<span class="caps">REDFISH</span> <span class="caps">PARAMETERS</span></p>
<hr />
<p>The <code>[redfish]</code> section can contain the following&nbsp;parameters:</p>
<p><strong>Uri=</strong></p>
<p>The <span class="caps">URI</span> to the Redfish service in the format <code>scheme://ip:port</code> for instance <code>https://192.168.0.133:443</code></p>
<p><strong>Username=</strong></p>
<p>The username to use when connecting to the Redfish&nbsp;service.</p>
<p><strong>Password=</strong></p>
<p>The password to use when connecting to the Redfish&nbsp;service.</p>
<p><strong>CACheck={{FU_REDFISH_CONFIG_DEFAULT_CA_CHECK}}</strong></p>
<p>Whether to verify the server certificate or not. This is turned off by default.
  BMCs using self-signed certificates will not work unless the plugin does not verify it against the system&nbsp;CAs.</p>
<p><strong>IpmiDisableCreateUser={{FU_REDFISH_CONFIG_DEFAULT_IPMI_DISABLE_CREATE_USER}}</strong></p>
<p>Do not use <span class="caps">IPMI</span> <span class="caps">KCS</span> to create an initial user account if no <span class="caps">SMBIOS</span> data.
  Setting this to <strong>true</strong> prevents creating user accounts on the <span class="caps">BMC</span>&nbsp;automatically.</p>
<p><strong>ManagerResetTimeout={{FU_REDFISH_CONFIG_DEFAULT_MANAGER_RESET_TIMEOUT}}</strong></p>
<p>Amount of time in seconds to wait for a <span class="caps">BMC</span> restart.
{% endif&nbsp;%}</p>
<h2 id="thunderbolt-parameters">THUNDERBOLT PARAMETERS<a class="md-anchor" href="#thunderbolt-parameters" title="Permanent link"></a></h2>
<p>The <code>[thunderbolt]</code> section can contain the following&nbsp;parameters:</p>
<p><strong>MinimumKernelVersion={{FU_THUNDERBOLT_CONFIG_DEFAULT_MINIMUM_KERNEL_VERSION}}</strong></p>
<p>Minimum kernel version to allow use of this&nbsp;plugin.</p>
<p>This only needs to be modified by enterprise kernels that have cherry picked the feature into a
  kernel with an old version&nbsp;number.</p>
<p><strong>DelayedActivation={{FU_THUNDERBOLT_CONFIG_DEFAULT_DELAYED_ACTIVATION}}</strong></p>
<p>Forces delaying activation until&nbsp;shutdown/logout/reboot.</p>
<h2 id="notes">NOTES<a class="md-anchor" href="#notes" title="Permanent link"></a></h2>
<p><code>{{SYSCONFDIR}}/fwupd/fwupd.conf</code> may contain either hardcoded or autogenerated credentials and must only be
readable by the user that is running the fwupd process, which is typically <code>root</code>.</p>
<h2 id="see-also">SEE ALSO<a class="md-anchor" href="#see-also" title="Permanent link"></a></h2>
<p><code>fwupdmgr(1)</code>
<code>fwupd-remotes.d(5)</code></p>
    </div>
  </section>
</section>


    
<div id="toc" class="toc">
  <nav aria-labelledby="toc-title">
    <p id="toc-title">Content</p>
    <ul class="toc-list">
      
        
        <li class="toc-list-item"><a href="#name"><span class="link-text">NAME</span></a></li>
          
        
        <li class="toc-list-item"><a href="#synopsis"><span class="link-text">SYNOPSIS</span></a></li>
          
        
        <li class="toc-list-item"><a href="#file-format"><span class="link-text">FILE FORMAT</span></a></li>
          
        
        <li class="toc-list-item"><a href="#daemon-parameters"><span class="link-text">DAEMON PARAMETERS</span></a></li>
          
        
        <li class="toc-list-item"><a href="#thunderbolt-parameters"><span class="link-text">THUNDERBOLT PARAMETERS</span></a></li>
          
        
        <li class="toc-list-item"><a href="#notes"><span class="link-text">NOTES</span></a></li>
          
        
        <li class="toc-list-item"><a href="#see-also"><span class="link-text">SEE ALSO</span></a></li>
          
        
      
    </ul>
  </nav>
</div>


    <section id="search" class="content hidden"></section>

    <footer>
    
    </footer>
  </div>
</body>
</html>