GRUB-PROTECT(1)

💅 GRUB-PROTECT(1) — bestie edition

okay so this is grub-protect, a User Commands girlie from the GRUB2 fam — she's here to tuck your disk key in safe with a key protector, and honestly? she ate. ✨

---

🌸 NAME 🌸

grub-protect — protect a disk key with a key protector

🦋 SYNOPSIS 🦋

grub-protect [OPTION...]

💖 DESCRIPTION 💖

grub-protect helps you protect a disk encryption key with a specified key protector. That's literally her whole job and she's obsessed with it.

The vibe: you've got a cleartext key lying around (rude, unsafe), and you use a GRUB key protector so that GRUB can go retrieve that key during boot and unlock your fully-encrypted disks automatically. No cap, that's the whole slay. 🔥

✨ OPTIONS ✨

Honestly there are a lot of these, so buckle up bestie, we're going through every single one. 💅

• -a, --action=add|remove — add a key protector to a key, or remove one from it. Pick your character arc.
• -p, --protector=tpm2 — set which key protector to use. rn the only one on the roster is tpm2 (that's just how it is, don't come for her).
• --tpm2-asymmetric=TYPE — set the type of SRK. Your options are RSA (RSA2048), RSA3072, RSA4096, and ECC (ECC_NIST_P256). (default: ECC) 🎀
• --tpm2-bank=ALG — set the bank of PCRs used to authorize key release. Choices: SHA1, SHA256, SHA384, or SHA512. (default: SHA256)
• --tpm2-device=FILE — set the path to the TPM2 device. (default: /dev/tpm0)
• --tpm2-evict — evict a previously persisted SRK from the TPM, if there even is one. bye felicia 👋
• --tpm2-keyfile=FILE — set the path to the file that contains the cleartext key you wanna protect.
• --tpm2-nvindex=NUM — store the sealed key in a persistent or NV index handle. fancy 💅
• --tpm2-outfile=FILE — set the path to the file that will contain the key after sealing. heads up: it must be accessible to GRUB during boot, so don't hide it somewhere GRUB can't reach, bestie 🙈
• --tpm2-pcrs=0[,1]... — set a comma-separated list of PCRs used to authorize key release, e.g. '7,11'. (default: 7)

⚠️ okay this one's important, listen up: please be aware that PCR 0~7 are used by the firmware, and the measurement result may change after a firmware update (for baremetal systems) or a package (OVMF/SLOF) update in the VM host. That may lead to the failure of key unsealing. 😭 so yeah, key goes bye-bye. you've been warned, fr fr.

• --tpm2-srk=NUM — set the SRK handle, if the SRK is to be made persistent.
• --tpm2key — use the TPM 2.0 Key File format. 🗂️
• -?, --help — give this help list
• --usage — give a short usage message
• -V, --version — print program version

🫶 little note from the original: mandatory or optional arguments to long options are also mandatory or optional for any corresponding short options. iykyk.

---

💀 REPORTING BUGS 💀

Found a bug? not the vibe, but ok — report it to <bug-grub@gnu.org>.

🌈 SEE ALSO 🌈

The full documentation for grub-protect is maintained as a Texinfo manual. If the info and grub-protect programs are properly installed at your site, the command

info grub-protect

should give you access to the complete manual. slay 🎀

---

GRUB2 2.12 💜 September 2026 — and that's the whole page bestie, mwah 💋 🦋✨