virt-fw-vars(1)

options:

-h, --help

show this help message and exit

-l, --loglevel LEVEL

set loglevel to LEVEL

-i, --input FILE

read edk2 or aws vars from FILE

--inplace, --in-place FILE

modify FILE in place

--extract-certs

extract all certificates

Variable options:

-d, --delete VAR

delete variable VAR, can be specified multiple times

--set-true VAR

set variable VAR to true, can be specified multiple times

--set-false VAR

set variable VAR to false, can be specified multiple times

--set-json FILE

set variables from json dump FILE

Boot configuration:

--set-boot-uri LINK

set network boot uri to LINK (once, using BootNext)

--append-boot-filepath FILE

append boot entry for FILE (permanent, using BootOrder)

shim.efi configuration:

--set-shim-debug

enable shim.efi debugging (pause for debugger attach)

--set-shim-verbose

enable shim.efi verbose messages

--set-fallback-verbose

enable fallback.efi verbose messages

--set-fallback-no-reboot

disable rebooting for fallback.efi

--set-sbat-level FILE

set SbatLevel variable

Secure boot setup options:

--set-pk, --set-pk-cert GUID FILE

set PK to x509 cert, loaded in pem or der format from FILE and with owner GUID

--add-kek, --add-kek-cert GUID FILE

add x509 cert to KEK, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times

--add-db, --add-db-cert GUID FILE

add x509 cert to db, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times

--add-db-hash GUID HASH

add sha256 HASH to db, with owner GUID, can be specified multiple times

--set-dbx FILE

initialize dbx with update from FILE

--add-dbx FILE

append dbx update from FILE

--add-dbx-cert GUID FILE

add x509 cert to dbx, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times

--add-dbx-hash GUID HASH

add sha256 HASH to dbx, with owner GUID, can be specified multiple times

--add-mok, --add-mok-cert GUID FILE

add x509 cert to MokList, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times

--add-mok-hash GUID HASH

add sha256 HASH to MokList, with owner GUID, can be specified multiple times

Secure boot convinience shortcuts:

--enroll-redhat

enroll default certificates for redhat platform

--enroll-microsoft

enroll default certificates for microsoft oem platform

--enroll-cert CERT

enroll using specified certificate

--enroll-generate CN

enroll using generated cert with given common name

--enroll-mgmt

enroll using external management guid

--no-microsoft

same as "--microsoft-db none"

--microsoft-db, --profile {none,win11,win23,win+rom23,uefi11,uefi23,uefi+rom23,redhat,redhat+rom,all}

choose microsoft db keys to enroll

--microsoft-kek {none,2011,2023,all}

choose microsoft KEK keys to enroll

--distro-keys DISTRO

add ca keys for DISTRO

--distro-list

list known distros

--sb, --secure-boot

enable secure boot mode

Print options:

-p, --print

print varstore

-v, --verbose

print varstore verbosely

--hashes

print signature db sha256 hashes

-x, --hexdump

print variable hexdumps

Output options:

-o, --output FILE

write edk2 or aws vars to FILE, using the same format the --input FILE has.

--output-aws FILE

write aws vars to FILE

--output-json FILE

write json dump to FILE

--output-auth DIR

write *.auth files to DIR