VIRT-FW-VARS(1)

🦋 NAME 🦋

okay so this is the manual page for virt-fw-vars (that's version 26.10 bestie, remember that number 💖)

---

✨ DESCRIPTION ✨

the virt-fw-vars utility is literally the moment for printing and modifying UEFI variable stores. the formats it supports are standard edk2 (the one ovmf and armvirt use, iykyk) and aws. that's it. that's the whole vibe.

here's the usage, copied exactly so you can't mess it up:

usage: virt-fw-vars [-h] [-l LEVEL] [-i FILE] [--inplace FILE]
       [--extract-certs] [-d VAR] [--set-true VAR]
       [--set-false VAR] [--set-json FILE] [--set-boot-uri LINK]
       [--append-boot-filepath FILE] [--set-shim-debug]
       [--set-shim-verbose] [--set-fallback-verbose]
       [--set-fallback-no-reboot] [--set-sbat-level FILE] [--set-pk GUID
       FILE] [--add-kek GUID FILE] [--add-db GUID FILE] [--add-db-hash
       GUID HASH] [--set-dbx FILE] [--add-dbx FILE] [--add-dbx-cert GUID
       FILE] [--add-dbx-hash GUID HASH] [--add-mok GUID FILE]
       [--add-mok-hash GUID HASH] [--enroll-redhat] [--enroll-microsoft]
       [--enroll-cert CERT] [--enroll-generate CN] [--enroll-mgmt]
       [--no-microsoft] [--microsoft-db
       {none,win11,win23,win+rom23,uefi11,uefi23,uefi+rom23,redhat,redhat+rom,all}]
       [--microsoft-kek {none,2011,2023,all}] [--distro-keys DISTRO]
       [--distro-list] [--sb] [-p] [-v] [--hashes] [-x] [-o FILE]
       [--output-aws FILE] [--output-json FILE] [--output-auth DIR]

Print and modify EFI variable stores. periodt. 💅

---

🎀 options: 🎀

• -h, --help — show this help message and dip out (exit)
• -l, --loglevel LEVEL — set loglevel to LEVEL
• -i, --input FILE — read edk2 or aws vars from FILE
• --inplace, --in-place FILE — modify FILE in place (yes, right there, no copy 🙈)
• --extract-certs — extract all certificates

---

🌸 Variable options: 🌸

• -d, --delete VAR — delete variable VAR, and yep you can specify it multiple times
• --set-true VAR — set variable VAR to true, can be specified multiple times
• --set-false VAR — set variable VAR to false, can be specified multiple times
• --set-json FILE — set variables from json dump FILE

---

🧚 Boot configuration: 🧚

• --set-boot-uri LINK — set network boot uri to LINK (once, using BootNext)
• --append-boot-filepath FILE — append boot entry for FILE (permanent, using BootOrder)

---

⭐ shim.efi configuration: ⭐

• --set-shim-debug — enable shim.efi debugging (it pauses for debugger attach, so don't panic when it just sits there 😭)
• --set-shim-verbose — enable shim.efi verbose messages
• --set-fallback-verbose — enable fallback.efi verbose messages
• --set-fallback-no-reboot — disable rebooting for fallback.efi
• --set-sbat-level FILE — set SbatLevel variable

---

👑 Secure boot setup options: 👑

• --set-pk, --set-pk-cert GUID FILE — set PK to x509 cert, loaded in pem or der format from FILE and with owner GUID
• --add-kek, --add-kek-cert GUID FILE — add x509 cert to KEK, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
• --add-db, --add-db-cert GUID FILE — add x509 cert to db, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
• --add-db-hash GUID HASH — add sha256 HASH to db, with owner GUID, can be specified multiple times
• --set-dbx FILE — initialize dbx with update from FILE
• --add-dbx FILE — append dbx update from FILE
• --add-dbx-cert GUID FILE — add x509 cert to dbx, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
• --add-dbx-hash GUID HASH — add sha256 HASH to dbx, with owner GUID, can be specified multiple times
• --add-mok, --add-mok-cert GUID FILE — add x509 cert to MokList, loaded in pem or der format from FILE and with owner GUID, can be specified multiple times
• --add-mok-hash GUID HASH — add sha256 HASH to MokList, with owner GUID, can be specified multiple times

---

🔥 Secure boot convinience shortcuts: 🔥

(that spelling is straight from the original, don't come for me 🫶)

• --enroll-redhat — enroll default certificates for redhat platform
• --enroll-microsoft — enroll default certificates for microsoft oem platform
• --enroll-cert CERT — enroll using specified certificate
• --enroll-generate CN — enroll using generated cert with given common name
• --enroll-mgmt — enroll using external management guid
• --no-microsoft — same as "--microsoft-db none"
• --microsoft-db, --profile {none,win11,win23,win+rom23,uefi11,uefi23,uefi+rom23,redhat,redhat+rom,all} — choose microsoft db keys to enroll
• --microsoft-kek {none,2011,2023,all} — choose microsoft KEK keys to enroll
• --distro-keys DISTRO — add ca keys for DISTRO
• --distro-list — list known distros
• --sb, --secure-boot — enable secure boot mode

---

💜 Print options: 💜

• -p, --print — print varstore
• -v, --verbose — print varstore verbosely (the way that this one gives main character energy in a terminal, honestly)
• --hashes — print signature db sha256 hashes
• -x, --hexdump — print variable hexdumps

---

🌈 Output options: 🌈

• -o, --output FILE — write edk2 or aws vars to FILE, using the same format the --input FILE has.
• --output-aws FILE — write aws vars to FILE
• --output-json FILE — write json dump to FILE
• --output-auth DIR — write *.auth files to DIR

---

🌸 EXAMPLES 🌸

Print variable store. — the chill one, look at your vars:

virt-fw-vars --input ${guest}_VARS.fd \
             --print --verbose

Enroll default (microsoft) secure boot certificates — the glow-up one:

virt-fw-vars --input OVMF_VARS.fd \
             --output OVMF_VARS.secboot.fd \
             --enroll-redhat \
             --secure-boot

---

💖 AUTHOR 💖

Gerd Hoffmann <kraxel@redhat.com> — an absolute icon, no cap 👑

---

and that's the whole page bestie!! this was virt-fw-vars version 26.10, dated October 2026 — go print a varstore for me, ily, bye 🫶✨🎀