secvarctl(1)

📦 version 1.1.0+git1.1d8b86b, in fedora 43, fedora 44, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

🎀 NAME 🎀

okay bestie, meet secvarctl — that's secvarctl(1) from the General Commands Manual 💖 — a command line tool for simplifying the reading and writing of secure boot variables.

the commands are:

read — read from the secure variable directory and print out information on their current contents
write — update the given variable's key value
validate — checks that the format and basic content requirements are met for the given file type
verify — checks that the given files are correctly signed by the current variables
generate — generates several different types of file formats relevant to updating secure variables

✨ SYNOPSIS ✨

secvarctl [OPTIONS]

secvarctl read [OPTIONS] <variable>

secvarctl write [OPTIONS] <variable> <file>

secvarctl validate [OPTIONS] <file type> <file>

secvarctl verify [OPTIONS] -u {Update Variables}

secvarctl generate <inputFormat>:<outputFormat> [OPTIONS] -i <inputFile>
-o <outputFile>

secvarctl generate reset [OPTIONS] -o <outputFile> -k <key> -c <crt> -n
<variable>

🌸 DESCRIPTION 🌸

so secvarctl is a whole suite of tools to manipulate secure boot keys on POWER. the entire point of it is to simplify and automate the process of reading, writing and generating secure boot keys. it lets you talk to your keys, through terminal commands, efficiently. no cap. those commands are ( read , write , validate , verify , generate ) 🫶

💅 secvarctl read

secvarctl read will read from the secure variable directory and print out information on their current contents. by default, the program assumes the data is an EFI Signature List and prints the contents in human readable form.

to print the raw data, use -r
the default secure variable directiory is /sys/firmware/secvar/vars/ defined in secvarctl.h
to specify a path to the variables, use -p <newPath>. Expected variable subdirectory names :{"PK", "KEK", "db", "dbx", "TS"} with contained data file "<varName>/data".
if no variable name is given, the program will try to print the data for any variable named one of the following {'PK','KEK','db','dbx', 'TS'}

NOTE: the 'TS' variable is not an ESL, it is 4 timestamps (64 bytes total) for each of the other variables.

type one of the variable names to get info on that key, NOTE does not work when -f option is present 🙈

to read the data of any esl file use -f <eslFileName>

💜 secvarctl write

secvarctl write will update the given variable's key value. 👑

the new key value is expected to be contained in a PKCS7/Signed Data Authenticated file signed with the current key.
by default, the write function will validate the contents of the auth file. if it is a success the file will be written to the variables "update" file.
the "update" file is expected to be in "<pathToVars>/<variable>/update".
the -p <pathToVars> option is the location of the subdirectories {"PK","KEK", "db", "dbx"} which contain an "update" file, the default path is /sys/firmware/secvar/vars/ defined in secvarctl.h
the -v option prints process info
the -f option skips the validation step and immediadetly writes content of "<file>" to "<variable/upate"
the <variable> requirement is expected to be one of the following {"PK","KEK", "db", "dbx"}

🦋 secvarctl validate

secvarctl validate will determine if the format and basic content requirements are met for the given file. ✨

the default type of "<file>" is an auth file containing a PKCS7/Signed Data and attatched esl.
ALL KEYS ARE EXPECTED TO BE SHA-256 and RSA 2048 🔥

THIS FUNCTION DOES NOT DO ANY COMPARISON AGAINST CURRENT KEYS (use verify for that)

for extra process and file content information use -v for verbose
to validate a file that contains update data for the dbx variable use -x
to validate a PKCS7 (expected DER), use -p <file>
to validate an Efi Signature List (ESL), use -e <file>
to validate a certificate (x509 in DER or PEM format), use -c <file>

🌈 secvarctl verify

secvarctl verify will determine if the update files are correctly signed by the current variables or not.

the -v command will give extra information on process information.
all given update files are expected to be a signed PKCS7/Signed Data authenticated file containing an attatched new ESL.
the updates should be signed according to the correct hierarchy rules:
- --PK can sign all other keys, (including itself),
- --KEK can sign db and dbx, cannot sign PK
- --db/dbx cannot sign KEK or PK
- --TS holds no power of the variables, only functions to hold the timestamps of the last update for each of the other variables. Cannot be manually updated
all updates have their format validated before any verification is done.
the -p <pathToVars> option is used to set the location of current variables with subdirectories {"PK","KEK", "db", "dbx", "TS"} which contain the {"update, "data", "size"} files, the default path is /sys/firmware/secvar/vars/ defined in secvarctl.h
the -c {Current Variables} option is used to specify the current variables manually. See OPTIONS for correct format of {Current variables}.
if the -w option is given then, if the verification passes, the updates will be commited to the "update" file of the given variable

🍓 secvarctl generate

secvarctl generate will use the given input file to generate the output file of the given file format type. 🧚

the -v option will give more process information.
to specify the desired input and output format the user must use the argument <inputFormat>:<outputFormat> with no spaces between the colon and the format types.
the accepted values for <inputFormat> are:
- [h]ash , A file containing only hashed data, use -h <hashAlg> to specifify the hash function used (default SHA256)
- [c]ert , An x509 certificate (PEM), RSA2048 and SHA256 ONLY
- [e]sl , An EFI Signature List
- [p]kcs7 , a PKCS7 file containing signed data
- [a]uth , A signed authensticated file containing a PKCS7 and the new data
- [f]ile , Any file type, Warning: no format validation will be done
the accepted values for <outputFormat> are:
- [h]ash , A file containing only hashed data, use -h <hashAlg> to specifify the hash function used (default SHA256)
- [e]sl , An EFI Signature List
- [p]kcs7 , a PKCS7 file containing signed data, must specify public and private keys and digest algorithm (default SHA256)
- [a]uth , A signed authenticated file containing a PKCS7 and the new data, must specify public and private keys, digest algorithm (default SHA256) and secure variable name
- [x] A presigned digest file containing only the hash of the new data in ESL format with extra metadata. This format need only be used when the user does not have access to private keys for signing and must send the digest to be signed through an external framework.
all input formats besides [f]ile will be prevalidated. to skip prevalidation of the input file, use -f to force to generation.
if [h]ash is input or output type be sure to specify the hashing algorithm to use by using the argument -h <hashAlg>. this argument does not effect the digest algortithm of the signed data in a [p]kcs7 or [a]uth file, these will always use SHA256.
accepted values for <hashAlg> are one of {'SHA256', 'SHA224', 'SHA1', 'SHA384', 'SHA512'}
additionally, when the output type is [p]kcs7 or [a]uth, the user must give at least one pair of public and private keys -c <cert> -k <privKey> to sign the input file with. however, if the user does not have access to their private keys and are only able to interact with a signing framework, they can use -s <sigFile> in replacement of the private key argument. <sigFile> would contain only the raw signed data of a digest generated with secvarctl generate c:x, it is important that both these commands use the same custom timestamp argument -t <YYYY-MM-DDThh:mm:ss>.
when generating an [a]uth file, it is required the user give the secure variable name that the auth file is for, -n <varName> , where <varName> is one of {"PK","KEK", "db", "dbx"}. this argument is also useful when the input file is an ESL for the dbx (use -n dbx) because then the prevalidation will look for an ESL containing a hash rather than an x509.
also, when the output type is a [p]kcs7 or [a]uth file, the user can use a custom timestamp with -t <time> , where <time> is in the format 'YYYY-MM-DDThh:mm:ss'. if this argument is not used then the current date and time are used.
when using the input type '[f]ile' it will be assumed to be a text file and if output file is '[e]sl', '[p]kcs7' or '[a]uth' it will be hashed according to <hashAlg> (default SHA256).
to make a variable reset file, the user can replace generate <inputFormat>:<outputFormat> with generate reset. this will generate an auth file around an empty ESL. thus, no input argument -i is required when making a reset file.

NOTE: GENERATION OF PKCS7 AND AUTH FILES ARE IN EXPERIMENTAL DEVELEPOMENT PHASE. THEY HAVE NOT BEEN THOROUGHLY TESTED YET. 💀

✨ OPTIONS ✨

Okay so, this is the whole flag buffet, bestie. No cap, every single option is here. 🫶

🌸 For `secvarctl [OPTIONS]`

--usage — show usage, the lil "how do I even" button. 🫶
--help — help text, your bestie when you're lost. 💅

🦋 For `secvarctl read [OPTIONS] <variable>`

--usage — show usage. ✨
--help — help text. 💖
-r — raw output. No filter, no chill. 💀
-f <input.esl> — read from file. 📂
-p </path/to/vars/> — read from path (subdirectories {"PK", "KEK, "db", "dbx", "TS"} each with files {"data", "size"} expected). 🗂️
<variable> — one of {"PK", "KEK, "db", "dbx", "TS"}. Pick your fighter. 👑

💖 For `secvarctl write [OPTIONS] <variable> <file>`

REQUIRED:

<variable> — one of {"PK", "KEK, "db", "dbx"}.
<file> — an auth file. 🔐

OPTIONS:

--usage — show usage. ✨
--help — help text. 💅
-v — verbose output, because we love details. 🗣️
-f — force update, no validation. It's giving "yolo" but for secure variables. ⚠️
-p </path/to/vars/> — write to file in path (subdirectories {"PK", "KEK, "db", "dbx"} each with "update" file expected). 📝

🎀 For `secvarctl validate [OPTIONS] <file type> <file>`

REQUIRED:

<file> — the input file, assumed to be auth file if not specified. 🔍

OPTIONS:

--usage — show usage. ✨
--help — help text. 💖
-v — verbose output. 🗣️
-x — dbx file (contains hash not x509). 🧬
-e <file> — ESL. 📜
-p <file> — PKCS7/Signed Data. ✍️
-c <file> — DER or PEM certificate. 🪪
-a <file> — DEFAULT, a signed authenticated file containg a pkcs7 and appended ESL. 👑

🌈 For `secvarctl verify [OPTIONS] -u {Update Variables}`

REQUIRED:

-u {Update Variables} — the updates to be run. 🏃‍♀️

OPTIONAL:

--usage — show usage. ✨
--help — help text. 💅
-v — verbose output. 🗣️
-p </path/to/vars/> — read from path (subdirectories {"PK", "KEK, "db", "dbx", "TS"} each with files {"data", "size"} expected). 🗂️
-w — write updates if verified. ✅
-c {Current Variables} — list of current variables. 📋

{Update Variables}:

Format: <varname_1> <file_1> <varname_2> <file_2> ...
Where <varname> is one of {"PK", "KEK, "db", "dbx"} and <file> is an auth file.
Note: Updates are verified in the order they are submitted. Order matters, bestie. 🫶

{Current Variables}:

Format: <varname_1> <file_1> <varname_2> <file_2> ...
Where <varname> is one of {"PK", "KEK, "db", "dbx", "TS"} and <file> is an esl file (unless TS).

👑 For `secvarctl generate <inputFormat>:<outputFormat> [OPTIONS] -i <inputFile> -o <outputFile>`

REQUIRED:

<inputFormat>:<outputFormat> — {'[c]ert', '[h]ash', '[e]sl', '[p]kcs7', '[a]uth', '[f]ile'}:{ '[h]ash', '[e]sl', '[p]kcs7', '[a]uth', '[x] presigned digest'} SEE DESCRIPTION FOR HELP. 🧠
-i <inputFile> — input file that has the format specified by <inputFormat>. 📥
-o <outputFile> — output file that will have the format specified by <outputFormat>. 📤

OPTIONAL:

--usage — show usage. ✨
--help — help text. 💅
-v — verbose output. 🗣️
-f — force generation, skips validation of input file and assumes it to be formatted according to <inputFormat>. ⚠️
-n <varName> — name of secure boot variable, used when generating an auth file, PKCS7, or when the input file contains hashed data rather than x509 (use '-n dbx'), current <varName> are: {'PK','KEK','db','dbx'}. 🏷️
-t <time> — where <time> is of the format described below. creates a custom timestamp used when generating an auth or PKCS7 file, if not given then current time is used, all times are in UTC. ⏰
- format of <time> = 'YYYY-MM-DDThh:mm:ss' where:
  - 'YYYY' four-digit year
  - 'MM' two-digit month (01=January, etc.)
  - 'DD' two-digit day of month (01 through 31)
  - 'T' appears literally
  - 'hh' two digits of hour (00 through 23) (am/pm NOT allowed)
  - 'mm' two digits of minute (00 through 59)
  - 'ss' two digits of second (00 through 59)
-h <hashAlg> — hash function, used when output or input format is hash, current values for <hashAlg> are: {'SHA256', 'SHA224', 'SHA1', 'SHA384', 'SHA512'}. 🧮
-k <privKey> — private key, used when generating pkcs7 or auth file. 🔑
-s <sigFile> — signed data file, alternative to internal signing, replacement of private key argument. ✍️
-c <certFile> — x509 certificate (PEM), used when generating pkcs7 or auth file. 🪪
reset — replaces <inputFormat>:<outputFormat> and generates an auth file with an empty ESL (a valid variable reset file), no input file required. Required arguments are output file, signer public and private key and variable name. 🔄

✨ EXAMPLES ✨

Bestie, here are the exact commands. Copy-paste responsibly. 💅

To read all current variables in default path:

$secvarctl read

To read the raw data of the PK in a specific location:

$secvarctl read -p /home/user1/myVars/ -r PK

To validate and write an auth file to the default KEK location:

$secvarctl write KEK updateFile.auth

To write to /home/user1/myVars/KEK/update with no formatting checks:

$secvarctl write -p /home/user1/ -f KEK updateFile.auth

To validate the format of an auth file:

$secvarctl validate authFile.auth

To validate the format of a ESL with extra process info:

$secvarctl validate -e eslFile.esl -v

To verify the desired updates against the default path and, if successful, commit the updates:

$secvarctl verify -w -u db dbUpdate.auth KEK kekUpdate.auth

To verify the desired updates against a specific set of signers with extra process info:

$secvarctl verify -v -c PK myPK.esl KEK myKEK.esl dbx myDBX.esl -u DB dbUpdate.auth PK pkUpdate.auth

To get the attatched ESL from an auth file:

$secvarctl generate a:e -i file.auth -o file.esl

To create an ESL from an x509 certificate:

$secvarctl generate c:e -i file.pem -o file.esl

To create SHA512 from a file:

$secvarctl generate f:h -h SHA512 -i file.txt -o file.hash

To create ESL from a hash:

$secvarctl generate h:e -h 512 -i file.has -o file.esl

To create an auth file from the esl containg a hash for a dbx update:

$secvarctl generate e:a -k signer.key -c signer.crt -n dbx -i file.esl -o file.auth

To create an auth file from a certificate for a KEK update (this will create an ESL from the certificate and use the ESL for the Auth File):

$secvarctl generate c:a -k signer.key -c signer.crt -n KEK -i file.crt -o file.auth

To create a PKCS7 file from an ESL for a db update with a custom timestamp:

$secvarctl generate e:p -k signer.key -c signer.crt -n db -t 2020-10-1T13:45:42 -i file.crt -o file.pkcs7

To create an empty update to reset the db variable:

$secvarctl generate reset -k signer.key -c signer.crt -n db -o db.auth

To create an auth file using an external signing framework for db update:

$secvarctl generate c:x -n db -t 2021-1-1T1:1:1 -i file.crt -o file.hash
<user sends file.hash to be signed by external entity, signature is now in file.sig>
$secvarctl generate c:a -n db -t 2021-1-1T1:1:1 -c signer.crt -s file.sig -i file.crt -o file.auth

💖 AUTHOR 💖

Nick Child nick.child@ibm.com 📧
Eric Richter 💜
Nayna Jain 💙

That's a wrap, bestie! This page is from secvarctl(1), version 0.3, dated 1 OCTOBER 2020. Stay iconic, stay secure, and may your variables always validate. 💅✨🫶

📦 where this page comes from

fedora 43: secvarctl 1.1.0-3.fc43 · Apache-2.0
fedora 44: secvarctl 1.1.0-4.fc44 · Apache-2.0
opensuse-leap 16.0: secvarctl 1.1.0+git1.1d8b86b-160000.2.2 · Apache-2.0
ubuntu questing: secvarctl 1.1.0-0ubuntu1
ubuntu resolute: secvarctl 1.1.0-0ubuntu2 · Apache-2.0
ubuntu stonking: secvarctl 1.1.0-0ubuntu4 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-18: a language model's rewrite of the original, under its terms

secvarctl(1)

🎀 NAME 🎀

✨ SYNOPSIS ✨

🌸 DESCRIPTION 🌸

💅 secvarctl read

💜 secvarctl write

🦋 secvarctl validate

🌈 secvarctl verify

🍓 secvarctl generate

✨ OPTIONS ✨

🌸 For secvarctl [OPTIONS]

🦋 For secvarctl read [OPTIONS] <variable>

💖 For secvarctl write [OPTIONS] <variable> <file>

🎀 For secvarctl validate [OPTIONS] <file type> <file>

🌈 For secvarctl verify [OPTIONS] -u {Update Variables}

👑 For secvarctl generate <inputFormat>:<outputFormat> [OPTIONS] -i <inputFile> -o <outputFile>

✨ EXAMPLES ✨

💖 AUTHOR 💖

🌸 For `secvarctl [OPTIONS]`

🦋 For `secvarctl read [OPTIONS] <variable>`

💖 For `secvarctl write [OPTIONS] <variable> <file>`

🎀 For `secvarctl validate [OPTIONS] <file type> <file>`

🌈 For `secvarctl verify [OPTIONS] -u {Update Variables}`

👑 For `secvarctl generate <inputFormat>:<outputFormat> [OPTIONS] -i <inputFile> -o <outputFile>`