---
name: "grub-protect"
section: "1"
platform: "linux"
package: "grub"
version: "2:2.16-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/grub-protect"
---

# grub-protect(1)

protect a disk key with a key protector

## NAME

grub-protect - protect a disk key with a key protector

## SYNOPSIS

**grub-protect** \[*OPTION*...\]

## DESCRIPTION

grub-protect helps to protect a disk encryption key with a specified key protector.

Protect a cleartext key using a GRUB key protector that can retrieve the key during boot to unlock fully-encrypted disks automatically.

- **-a**, **--action**=*add*\|remove

  Add or remove a key protector to or from a key.

- **-p**, **--protector**=*tpm2*

  Set key protector to use (only tpm2 is currently supported).

- **--tpm2-asymmetric**=*TYPE* Set the type of SRK: RSA (RSA2048) and ECC

  (ECC\_NIST\_P256).(default: ECC)

- **--tpm2-bank**=*ALG*

  Set the bank of PCRs used to authorize key release: SHA1, SHA256, SHA384, or SHA512. (default: SHA256)

- **--tpm2-device**=*FILE*

  Set the path to the TPM2 device. (default: */dev/tpm0*)

- **--tpm2-evict**

  Evict a previously persisted SRK from the TPM, if any.

- **--tpm2-keyfile**=*FILE*

  Set the path to a file that contains the cleartext key to protect.

- **--tpm2-nvindex**=*NUM*

  Store the sealed key in a persistent or NV index handle.

- **--tpm2-outfile**=*FILE*

  Set the path to the file that will contain the key after sealing (must be accessible to GRUB during boot).

- **--tpm2-pcrs**=*0\[*,1\]...

  Set a comma-separated list of PCRs used to authorize key release e.g., '7,11'. Please be aware that PCR 0~7 are used by the firmware and the measurement result may change after a firmware update (for baremetal systems) or a package (OVMF/SLOF) update in the VM host. This may lead to the failure of key unsealing. (default: 7)

- **--tpm2-srk**=*NUM*

  Set the SRK handle if the SRK is to be made persistent.

- **--tpm2key**

  Use TPM 2.0 Key File format.

- \-?, **--help**

  give this help list

- **--usage**

  give a short usage message

- **-V**, **--version**

  print program version

Mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options.

## REPORTING BUGS

Report bugs to \<bug-grub@gnu.org\>.

## SEE ALSO

The full documentation for **grub-protect** is maintained as a Texinfo manual.  If the **info** and **grub-protect** programs are properly installed at your site, the command

-

  **info grub-protect**

should give you access to the complete manual.