---
name: "virt-fw-vars"
section: "1"
platform: "linux"
package: "virt-firmware"
version: "26.10-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/virt-fw-vars"
---

# virt-fw-vars(1)

manual page for virt-fw-vars 26.10

## NAME

virt-fw-vars - manual page for virt-fw-vars 26.10

## DESCRIPTION

The virt-fw-vars utility can print and modify UEFI variable stores. Supported formats are standard edk2 (as used by ovmf and armvirt) and aws.

usage: virt-fw-vars \[-h\] \[-l LEVEL\] \[-i FILE\] \[--inplace FILE\]

- \[--extract-certs\] \[-d VAR\] \[--set-true VAR\]

  \[--set-false VAR\] \[--set-json FILE\] \[--set-boot-uri LINK\] \[--append-boot-filepath FILE\] \[--set-shim-debug\] \[--set-shim-verbose\] \[--set-fallback-verbose\] \[--set-fallback-no-reboot\] \[--set-sbat-level FILE\] \[--set-pk GUID FILE\] \[--add-kek GUID FILE\] \[--add-db GUID FILE\] \[--add-db-hash GUID HASH\] \[--set-dbx FILE\] \[--add-dbx FILE\] \[--add-dbx-cert GUID FILE\] \[--add-dbx-hash GUID HASH\] \[--add-mok GUID FILE\] \[--add-mok-hash GUID HASH\] \[--enroll-redhat\] \[--enroll-microsoft\] \[--enroll-cert CERT\] \[--enroll-generate CN\] \[--enroll-mgmt\] \[--no-microsoft\] \[--microsoft-db {none,win11,win23,win+rom23,uefi11,uefi23,uefi+rom23,redhat,redhat+rom,all}\] \[--microsoft-kek {none,2011,2023,all}\] \[--distro-keys DISTRO\] \[--distro-list\] \[--sb\] \[-p\] \[-v\] \[--hashes\] \[-x\] \[-o FILE\] \[--output-aws FILE\] \[--output-json FILE\] \[--output-auth DIR\]

Print and modify EFI variable stores.

### options:

- **-h**, **--help**

  show this help message and exit

- **-l**, **--loglevel** LEVEL

  set loglevel to LEVEL

- **-i**, **--input** FILE

  read edk2 or aws vars from FILE

- **--inplace**, **--in-place** FILE

  modify FILE in place

- **--extract-certs**

  extract all certificates

### Variable options:

- **-d**, **--delete** VAR

  delete variable VAR, can be specified multiple times

- **--set-true** VAR

  set variable VAR to true, can be specified multiple times

- **--set-false** VAR

  set variable VAR to false, can be specified multiple times

- **--set-json** FILE

  set variables from json dump FILE

### Boot configuration:

- **--set-boot-uri** LINK

  set network boot uri to LINK (once, using BootNext)

- **--append-boot-filepath** FILE

  append boot entry for FILE (permanent, using BootOrder)

### shim.efi configuration:

- **--set-shim-debug**

  enable shim.efi debugging (pause for debugger attach)

- **--set-shim-verbose**

  enable shim.efi verbose messages

- **--set-fallback-verbose**

  enable fallback.efi verbose messages

- **--set-fallback-no-reboot**

  disable rebooting for fallback.efi

- **--set-sbat-level** FILE

  set SbatLevel variable

### Secure boot setup options:

- **--set-pk**, **--set-pk-cert** GUID FILE

  set PK to x509 cert, loaded in pem or der format from FILE and with owner GUID

- **--add-kek**, **--add-kek-cert** GUID FILE

  add x509 cert to KEK, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times

- **--add-db**, **--add-db-cert** GUID FILE

  add x509 cert to db, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times

- **--add-db-hash** GUID HASH

  add sha256 HASH to db, with owner GUID, can be specified multiple times

- **--set-dbx** FILE

  initialize dbx with update from FILE

- **--add-dbx** FILE

  append dbx update from FILE

- **--add-dbx-cert** GUID FILE

  add x509 cert to dbx, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times

- **--add-dbx-hash** GUID HASH

  add sha256 HASH to dbx, with owner GUID, can be specified multiple times

- **--add-mok**, **--add-mok-cert** GUID FILE

  add x509 cert to MokList, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times

- **--add-mok-hash** GUID HASH

  add sha256 HASH to MokList, with owner GUID, can be specified multiple times

### Secure boot convinience shortcuts:

- **--enroll-redhat**

  enroll default certificates for redhat platform

- **--enroll-microsoft**

  enroll default certificates for microsoft oem platform

- **--enroll-cert** CERT

  enroll using specified certificate

- **--enroll-generate** CN

  enroll using generated cert with given common name

- **--enroll-mgmt**

  enroll using external management guid

- **--no-microsoft**

  same as "--microsoft-db none"

- **--microsoft-db**, **--profile** {none,win11,win23,win+rom23,uefi11,uefi23,uefi+rom23,redhat,redhat+rom,all}

  choose microsoft db keys to enroll

- **--microsoft-kek** {none,2011,2023,all}

  choose microsoft KEK keys to enroll

- **--distro-keys** DISTRO

  add ca keys for DISTRO

- **--distro-list**

  list known distros

- **--sb**, **--secure-boot**

  enable secure boot mode

### Print options:

- **-p**, **--print**

  print varstore

- **-v**, **--verbose**

  print varstore verbosely

- **--hashes**

  print signature db sha256 hashes

- **-x**, **--hexdump**

  print variable hexdumps

### Output options:

- **-o**, **--output** FILE

  write edk2 or aws vars to FILE, using the same format the **--input** FILE has.

- **--output-aws** FILE

  write aws vars to FILE

- **--output-json** FILE

  write json dump to FILE

- **--output-auth** DIR

  write \*.auth files to DIR

## EXAMPLES

- Print variable store.

  virt-fw-vars --input ${guest}\_VARS.fd \\\
                \--print --verbose

- Enroll default (microsoft) secure boot certificates

  virt-fw-vars --input OVMF\_VARS.fd \\\
                \--output OVMF\_VARS.secboot.fd \\\
                \--enroll-redhat \\\
                \--secure-boot

## AUTHOR

Gerd Hoffmann \<kraxel@redhat.com\>