virt-fw-vars(1)

VIRT-FW-VARS(1)

User Commands

VIRT-FW-VARS(1)

NAME

virt-fw-vars - manual page for virt-fw-vars 26.2

The virt-fw-vars utility can print and modify UEFI variable stores. Supported formats are standard edk2 (as used by ovmf and armvirt) and aws.

usage: virt-fw-vars [-h] [-l LEVEL] [-i FILE] [--inplace FILE]

[--extract-certs] [-d VAR] [--set-true VAR]: [--set-false VAR] [--set-json FILE] [--set-boot-uri LINK] [--append-boot-filepath FILE] [--set-shim-debug] [--set-shim-verbose] [--set-fallback-verbose] [--set-fallback-no-reboot] [--set-sbat-level FILE] [--set-pk GUID FILE] [--add-kek GUID FILE] [--add-db GUID FILE] [--add-db-hash GUID HASH] [--set-dbx FILE] [--add-dbx FILE] [--add-dbx-cert GUID FILE] [--add-dbx-hash GUID HASH] [--add-mok GUID FILE] [--add-mok-hash GUID HASH] [--enroll-redhat] [--enroll-cert CERT] [--enroll-generate CN] [--enroll-mgmt] [--no-microsoft] [--microsoft-db {none,win11,win23,win+rom23,uefi11,uefi23,uefi+rom23,redhat,redhat+rom,all}] [--microsoft-kek {none,2011,2023,all}] [--distro-keys DISTRO] [--distro-list] [--sb] [-p] [-v] [--hashes] [-x] [-o FILE] [--output-aws FILE] [--output-json FILE] [--output-auth DIR]

Print and modify EFI variable stores.

--set-boot-uri LINK: set network boot uri to LINK (once, using BootNext)
--append-boot-filepath FILE: append boot entry for FILE (permanent, using BootOrder)

--set-pk, --set-pk-cert GUID FILE: set PK to x509 cert, loaded in pem or der format from FILE and with owner GUID
--add-kek, --add-kek-cert GUID FILE: add x509 cert to KEK, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
--add-db, --add-db-cert GUID FILE: add x509 cert to db, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
--add-db-hash GUID HASH: add sha256 HASH to db, with owner GUID, can be specified multiple times
--set-dbx FILE: initialize dbx with update from FILE
--add-dbx FILE: append dbx update from FILE
--add-dbx-cert GUID FILE: add x509 cert to dbx, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
--add-dbx-hash GUID HASH: add sha256 HASH to dbx, with owner GUID, can be specified multiple times
--add-mok, --add-mok-cert GUID FILE: add x509 cert to MokList, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
--add-mok-hash GUID HASH: add sha256 HASH to MokList, with owner GUID, can be specified multiple times

--enroll-redhat: enroll default certificates for redhat platform
--enroll-cert CERT: enroll using specified certificate
--enroll-generate CN: enroll using generated cert with given common name
--enroll-mgmt: enroll using external management guid
--no-microsoft: same as "--microsoft-db none"
--microsoft-db, --profile {none,win11,win23,win+rom23,uefi11,uefi23,uefi+rom23,redhat,redhat+rom,all}: choose microsoft db keys to enroll
--microsoft-kek {none,2011,2023,all}: choose microsoft KEK keys to enroll
--distro-keys DISTRO: add ca keys for DISTRO
--distro-list: list known distros
--sb, --secure-boot: enable secure boot mode

-o, --output FILE: write edk2 or aws vars to FILE, using the same format the --input FILE has.
--output-aws FILE: write aws vars to FILE
--output-json FILE: write json dump to FILE
--output-auth DIR: write *.auth files to DIR

Print variable store.: virt-fw-vars --input ${guest}_VARS.fd \
--print --verbose
Enroll default (microsoft) secure boot certificates: virt-fw-vars --input OVMF_VARS.fd \
--output OVMF_VARS.secboot.fd \
--enroll-redhat \
--secure-boot

Gerd Hoffmann <kraxel@redhat.com>

February 2026

virt-fw-vars 26.2