VIRT-FW-VARS(1)

NAME
virt-fw-vars - manual page for virt-fw-vars 23.11

DESCRIPTION
The virt-fw-vars utility can print and modify UEFI variable stores. Supported formats are standard edk2 (as used by ovmf and armvirt) and aws.

usage: virt-fw-vars [-h] [-l LEVEL] [-i FILE] [--extract-certs] [-d VAR]

[--set-true VAR] [--set-false VAR] [--set-json FILE]
    [--set-boot-uri LINK] [--append-boot-filepath FILE] [--set-shim-debug] [--set-shim-verbose] [--set-fallback-verbose] [--set-fallback-no-reboot] [--set-sbat-level FILE] [--set-pk GUID FILE] [--add-kek GUID FILE] [--add-db GUID FILE] [--set-dbx FILE] [--add-mok GUID FILE] [--add-db-hash GUID HASH] [--add-mok-hash GUID HASH] [--enroll-redhat] [--enroll-cert CERT] [--enroll-generate CN] [--no-microsoft] [--distro-keys DISTRO] [--sb] [-p] [-v] [-x] [-o FILE] [--output-aws FILE] [--output-json FILE]

  options:

-h, --help
    show this help message and exit

-l LEVEL, --loglevel LEVEL
    set loglevel to LEVEL

-i FILE, --input FILE
    read edk2 or aws vars from FILE

--extract-certs
    extract all certificates

  Variable options:

-d VAR, --delete VAR
    delete variable VAR, can be specified multiple times

--set-true VAR
    set variable VAR to true, can be specified multiple times

--set-false VAR
    set variable VAR to false, can be specified multiple times

--set-json FILE
    set variables from json dump FILE

  Boot configuration:

--set-boot-uri LINK
    set network boot uri to LINK (once, using BootNext)

--append-boot-filepath FILE
    append boot entry for FILE (permanent, using BootOrder)

  shim.efi configuration:

--set-shim-debug
    enable shim.efi debugging (pause for debugger attach)

--set-shim-verbose
    enable shim.efi verbose messages

--set-fallback-verbose
    enable fallback.efi verbose messages

--set-fallback-no-reboot
    disable rebooting for fallback.efi

--set-sbat-level FILE
    set SbatLevel variable

  Secure boot setup options:

--set-pk GUID FILE
    set PK to x509 cert, loaded in pem format from FILE and with owner GUID

--add-kek GUID FILE
    add x509 cert to KEK, loaded in pem format from FILE and with owner GUID, can be specified multiple times

--add-db GUID FILE
    add x509 cert to db, loaded in pem format from FILE and with owner GUID, can be specified multiple times

--set-dbx FILE
    initialize dbx with update from FILE

--add-mok GUID FILE
    add x509 cert to MokList, loaded in pem format from FILE and with owner GUID, can be specified multiple times

--add-db-hash GUID HASH
    add sha256 HASH to db, with owner GUID, can be specified multiple times

--add-mok-hash GUID HASH
    add sha256 HASH to MokList, with owner GUID, can be specified multiple times

  Secure boot convinience shortcuts:

--enroll-redhat
    enroll default certificates for redhat platform

--enroll-cert CERT
    enroll using specified certificate

--enroll-generate CN
    enroll using generated cert with given common name

--no-microsoft
    do not add microsoft keys

--distro-keys DISTRO
    add ca keys for DISTRO

--sb, --secure-boot
    enable secure boot mode

  Print options:

-p, --print
    print varstore

-v, --verbose
    print varstore verbosely

-x, --hexdump
    print variable hexdumps

  Output options:

-o FILE, --output FILE
    write edk2 or aws vars to FILE, using the same format the --input FILE has.

--output-aws FILE
    write aws vars to FILE

--output-json FILE
    write json dump to FILE

EXAMPLES

Print variable store.
    virt-fw-vars --input ${guest}_VARS.fd \
                 --print --vwerbose

Enroll default (microsoft) secure boot certificates
    virt-fw-vars --input OVMF_VARS.fd \
                 --output OVMF_VARS.secboot.fd \
                 --enroll-redhat \
                 --secure-boot

AUTHOR
Gerd Hoffmann <kraxel@redhat.com>