NAME
grub-protect - protect a disk key with a key protector
SYNOPSIS
grub-protect [OPTION...]
DESCRIPTION
grub-protect helps to protect a disk encryption key with a specified key protector.
Protect a cleartext key using a GRUB key protector that can retrieve the key during boot to unlock fully-encrypted disks automatically.
- -a, --action=add|remove
-
Add or remove a key protector to or from a key.
- -p, --protector=tpm2
-
Set key protector to use (only tpm2 is currently supported).
- --tpm2-asymmetric=TYPE Set the type of SRK: RSA (RSA2048) and ECC
-
(ECC_NIST_P256).(default: ECC)
- --tpm2-bank=ALG
-
Set the bank of PCRs used to authorize key release: SHA1, SHA256, SHA384, or SHA512. (default: SHA256)
- --tpm2-device=FILE
-
Set the path to the TPM2 device. (default: /dev/tpm0)
- --tpm2-evict
-
Evict a previously persisted SRK from the TPM, if any.
- --tpm2-keyfile=FILE
-
Set the path to a file that contains the cleartext key to protect.
- --tpm2-nvindex=NUM
-
Store the sealed key in a persistent or NV index handle.
- --tpm2-outfile=FILE
-
Set the path to the file that will contain the key after sealing (must be accessible to GRUB during boot).
- --tpm2-pcrs=0[,1]...
-
Set a comma-separated list of PCRs used to authorize key release e.g., '7,11'. Please be aware that PCR 0~7 are used by the firmware and the measurement result may change after a firmware update (for baremetal systems) or a package (OVMF/SLOF) update in the VM host. This may lead to the failure of key unsealing. (default: 7)
- --tpm2-srk=NUM
-
Set the SRK handle if the SRK is to be made persistent.
- --tpm2key
-
Use TPM 2.0 Key File format.
- -?, --help
-
give this help list
- --usage
-
give a short usage message
- -V, --version
-
print program version
Mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options.
REPORTING BUGS
Report bugs to <[email protected]>.
SEE ALSO
The full documentation for grub-protect is maintained as a Texinfo manual. If the info and grub-protect programs are properly installed at your site, the command
-
info grub-protect
should give you access to the complete manual.