MOKUTIL(1)

💖 mokutil 💖

okay bestie, meet mokutil 🧚 It's the General Commands Manual tool for manipulating machine owner keys, aka MOKs. 🎀

✨ NAME ✨

mokutil — utility to manipulate machine owner keys 🔑

🌸 SYNOPSIS 🌸

mokutil [--list-enrolled | -l]
        ([--mokx | -X])
mokutil [--list-new | -N]
        ([--mokx | -X])
mokutil [--list-delete | -D]
        ([--mokx | -X])
mokutil [--import keylist| -i keylist]
        ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
         [--mokx | -X] | [--ca-check] | [--ignore-keyring])
mokutil [--delete keylist | -d keylist]
        ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
         [--mokx |- X])
mokutil [--revoke-import]
        ([--mokx | -X])
mokutil [--revoke-delete]
        ([--mokx | -X])
mokutil [--export | -x]
mokutil [--password | -p]
        ([--hash-file hashfile | -f hashfile] | [--root-pw | -P])
mokutil [--clear-password | -c]
mokutil [--disable-validation]
mokutil [--enable-validation]
mokutil [--sb-state]
mokutil [--test-key keyfile | -t keyfile]
        ([--mokx | -X] | [--ca-check] | [--ignore-keyring])
mokutil [--reset]
        ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
         [--mok | -X])
mokutil [--generate-hash=password | -gpassword]
mokutil [--ignore-db]
mokutil [--use-db]
mokutil [--import-hash hash]
        ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
         [--mokx | -X])
mokutil [--delete-hash hash]
        ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
         [--mokx | -X])
mokutil [--set-verbosity (true | false)]
mokutil [--set-fallback-verbosity (true | false)]
mokutil [--set-fallback-noreboot (true | false)]
mokutil [--pk]
mokutil [--kek]
mokutil [--db]
mokutil [--dbx]
mokutil [--list-sbat-revocations]
mokutil [--set-sbat-policy (latest | automatic | delete)]
mokutil [--timeout -1,0..0x7fff]
mokutil [--trust-mok]
mokutil [--untrust-mok]

🦋 DESCRIPTION 🦋

So basically, mokutil is the tool you use to import or delete the machine owner keys (MOK) stored in the database of shim. It's giving key management energy. 🔑✨

💅 OPTIONS 💅

• -l, --list-enrolled — show the keys that are already stored in the database 📜
• -N, --list-new — list the keys that are waiting to be enrolled 🌱
• -D, --list-delete — list the keys that are set to be deleted 🗑️
• -i, --import — grab the files you list and build an enrolling request for shim. The files have to be in DER format, no exceptions 📂
• -d, --delete — grab the files you list and build a deleting request for shim. These also have to be in DER format 🙅‍♀️
• --revoke-import — cancel the current import request (MokNew) 🙈
• --revoke-delete — cancel the current delete request (MokDel) 🙈
• -x, --export — export the keys stored in MokListRT 📤
• -p, --password — set up the password for MokManager (MokPW) 🔐
• -c, --clear-password — clear the password for MokManager (MokPW) 🧹
• --disable-validation — disable the validation process in shim 🙅‍♀️
• --enable-validation — enable the validation process in shim ✅
• --sb-state — show the SecureBoot state 👀
• -t, --test-key — check whether the key is enrolled or not 🔍
• --reset — reset the MOK list 💫
• --generate-hash — generate the password hash 🧂
• --hash-file — use the password hash from a specific file 📁
• -P, --root-pw — use the root password hash from /etc/shadow 👑
• --ignore-db — tell shim to not use the keys in db to verify EFI images 🙃
• --use-db — tell shim to use the keys in db to verify EFI images (this is the default, bestie) 💜
• -X, --mokx — work with the MOK blacklist (MOKX) instead of the MOK list 🚫
• --import-hash — create an enrolling request for the hash of a key in DER format. Heads up, this is NOT the password hash! 🙅‍♀️
• --delete-hash — create a deleting request for the hash of a key in DER format. Again, this is NOT the password hash! 🙅‍♀️
• --set-verbosity — set the SHIM_VERBOSE so shim can be more or less chatty 🗣️
• --set-fallback-verbosity — set the FALLBACK_VERBOSE so fallback can be more or less chatty 🗣️
• --set-fallback-noreboot — set the FB_NO_REBOOT so fallback doesn't automatically reboot the system 🛑
• --pk — list the keys in the public Platform Key (PK) 🏰
• --kek — list the keys in the Key Exchange Key Signature database (KEK) 🗝️
• --db — list the keys in the secure boot signature store (db) ✍️
• --dbx — list the keys in the secure boot blacklist signature store (dbx) 🚷
• --list-sbat-revocations — list the entries in the Secure Boot Advanced Targeting store (SBAT) 🎯
• --set-sbat-policy (latest | automatic) — set the SbatPolicy UEFI Variable so shim applies either the latest or the automatic SBAT revocations. If UEFI Secure Boot is disabled, shim will automatically delete the SBAT revocations 🧹
• --set-ssp-policy (latest | automatic | delete) — set the SspPolicy UEFI Variable so shim applies either the latest or the automatic Windows SkuSiPolicy to manage bootmgr revocations. These are non-native revocations, so shim won't automatically delete them. If you need them gone, spp-policy can be set to delete when Secure Boot is disabled. The delete policy is non-persistent, so keep that in mind 🫶
• --timeout — set the timeout for the MOK prompt ⏰
• --ca-check — check whether the CA of the given key is already enrolled or blocked in the key databases 🕵️‍♀️
• --ignore-keyring — skip the kernel builtin trusted keys keyring check when enrolling a key into MokList 🙈
• --trust-mok — trust MOK keys within the kernel keyring 💖
• --untrust-mok — don't trust MOK keys within the kernel keyring 🥀

That's the whole manual, bestie! 🌈💖 Go be a main character with your keys. 💅✨