fwupd.conf(5)

📦
version 2.1.9 · 9 versions
, in fedora 44, nixpkgs unstable

💖 fwupd.conf — the config file for the fwupd daemon 💖

okay so before we even start: this is the manual page for fwupd.conf(5), aka the ✨Configuration File Format✨ for fwupd. bestie, you're gonna want a snack, it's a long one.

🌸 NAME 🌸

fwupd.conf — the configuration file for the fwupd daemon. that's it, that's the name, slay.

🦋 SYNOPSIS 🦋

The /etc/fwupd/fwupd.conf file is the main configuration file for the fwupd daemon. Like, the whole file format and every possible parameter is documented right here, for reference purposes. we're giving you the full lore, no gatekeeping 💅

🎀 FILE FORMAT 🎀

The file has multiple sections, and each section can hold optional parameters. Parameters look like this:

[section]
key = value

The file is line-based, bestie. Every newline-terminated line is either a comment, a section name, or a parameter. that's the whole vibe.

Section names and parameter names are case sensitive. don't come for me, it's just how it is.

Only the first equals sign in a parameter is significant. Whitespace before or after that first equals sign gets discarded, same as leading and trailing whitespace in a parameter value. But internal whitespace inside the value? retained. it stays. periodt.

Any line starting with a hash (#) is ignored, and so are lines that are only whitespace. ghost lines, we don't see them 🫶

The values after the equals sign are all either:

  • a string (no quotes needed, we're not doing all that),
  • an unsigned integer, or
  • a boolean, which you can write as true or false.

Case is not significant in boolean values, but it is preserved in string values. iconic behaviour tbh.

👑 DAEMON PARAMETERS 👑

The [fwupd] section can contain the following parameters — this is the main character section fr fr:

  • DisabledDevices= — let you block specific devices by their GUID, using semicolons as the delimiter.
  • DisabledPlugins= — let you block specific plugins by name. run fwupdmgr get-plugins to get the list of plugins. iykyk.
  • ArchiveSizeMax= — the maximum archive size that can be loaded, in Mb. the default is 25% of your total system memory.
  • IdleTimeout=300 — idle time in seconds before the daemon shuts down. a value of 0 means "never".
NOTE: some plugins might inhibit the auto-shutdown, for instance thunderbolt. rude of them but ok.
  • IdleInhibitStartupThreshold=500 — if the daemon takes more than this time to start up (in milliseconds) then inhibit the idle shutdown timer. a value of 0 specifies "never".
  • VerboseDomains= — a comma separated list of domains to log in verbose mode. if unset, no domains are set to verbose. if set to *, all domains are verbose, which is the same as running the daemon with --verbose --verbose. go off, live your loudest life.
  • UpdateMotd=true — update the message of the day (MOTD) on device and metadata changes.
  • EnumerateAllDevices=false — for some plugins, enumerate only devices supported by metadata.
  • ApprovedFirmware= — a list of firmware checksums that has been approved by the site admin. If unset, all firmware is approved.
  • UriSchemes=file;https;http;ipfs — allowed URI schemes, in preference order. failed downloads from the first scheme get retried with the next one in order until no choices remain. it's giving backup plan energy.
  • IgnorePower=false — ignore power levels of devices when running updates.
  • IgnoreRequirements=false — ignore some device requirements, for instance removing the generic GUID requirement of a CHID, child, parent or sibling.
this is not recommended for production systems, although it may be useful for firmware development. you've been warned bestie 💀
  • IgnoreEfivarsFreeSpace=false — ignore the efivars free space requirement for db, dbx, KEK and PK updates. this may be required on Linux kernels older than 6.4, or where the hardware does not support UEFI RT->QueryVariableInfo.
  • OnlyTrustPostQuantumSignatures=false — only trust post-quantum cryptographic signatures. this is only recommended when you are sure the firmware contains a valid PQ signature. 🔐
  • OnlyTrusted=true — only support installing firmware signed with a trusted key. do not set this to false on a production or trusted system. like, genuinely, don't.
  • ShowDevicePrivate=true — show data such as device serial numbers which some users may consider private. 🙈
  • TrustedUids= — UIDs matching these values that call the D-Bus interface should be marked as trusted.
  • HostBkc= — a comma separated list of best known configuration IDs to be used when using fwupdmgr sync. this can downgrade firmware to factory versions or upgrade firmware to a supported config level. e.g. vendor-factory-2021q1,mycompany-2023.
  • ReleaseDedupe=true — deduplicate duplicate releases by the archive checksum that are available from more than one source.
  • ReleasePriority=local — when the same version release is available from more than one source, this option can be used to either prefer the local version (avoiding a potentially expensive download) or to prefer the remote version (which may have updated metadata such as release notes).

The possible options are local or remote, or empty to not make any adjustment to the policy, relying on the OrderAfter and OrderBefore sections in the remote. no notes, that's just the deal.

  • EspLocation= — set the preferred location used for the EFI system partition (ESP) path. this is typically used if UDisks was not able to automatically identify the location for any reason.
  • RequireImmutableEnumeration=false — don't allow fwupd plugins to directly interact with devices during probe or setup stages. the kernel should provide all device information in sysfs files or udev properties.
heads up: this will block some plugins from working. 💀
  • Manufacturer=
  • ProductName=
  • ProductSku=
  • Family=
  • EnclosureKind=
  • BaseboardProduct=
  • BaseboardManufacturer=

these override values for SMBIOS or Device Tree data on the local system. they're only required when the SMBIOS or Device Tree data is invalid, missing, or to simulate running on another system. empty values should be used to populate blank entries, or add values to populate specific entries. it's giving cosplay but for hardware ✨

  • TrustedReports=VendorId=$OEM — vendor reports matching these expressions will have releases marked as trusted-report. each OR section is delimited by a ; and each AND section is delimited by &, e.g.
    • DistroId=chromeos — any report uploaded from ChromeOS is trusted.
    • DistroId=chromeos&RemoteId=lvfs — any report found in the lvfs remote uploaded from a ChromeOS machine is trusted.
    • DistroId=fedora&VendorId=19 — any report uploaded from Fedora 19 is trusted.
    • DistroId=fedora&VendorId=$OEM — any report uploaded from Fedora by the hardware OEM is trusted.
    • DistroId=fedora;DistroId=rhel&DistroVersion=9 — any report uploaded from Fedora (any version) or from RHEL 9 is trusted.
NOTE: a VendorId of $OEM represents the OEM vendor ID of the vendor that owns the firmware, for example, where Lenovo QA has generated a signed report for a Lenovo laptop.

There are also three os-release values available, $ID, $VERSION_ID and $VARIANT_ID, which allow expressions like:

  • DistroId=$ID
  • DistroId=$ID,DistroVersion=$VERSION_ID
  • Flags=is-upgrade,from-oem

any flags listed here must all be matched by the report.

  • P2pPolicy=metadata — this tells the daemon what peer-to-peer policy to use. for instance, using Passim, an optional local caching service. using peer-to-peer data might reduce the amount of bandwidth used on your network considerably. environmentally friendly queen behavior 🌈

There are three possible values:

  • nothing: do not publish any files
  • metadata: only publish shared metadata that is common to each machine.
  • firmware: only publish firmware archives after the next reboot of the machine.

At some point in the future fwupd will change the default to metadata,firmware. 👀 noted.

  • TestDevices=false — create virtual test devices and remote for validating daemon flows. this is only intended for CI testing and development purposes. don't be weird with it.

💅 UEFI_CAPSULE PARAMETERS 💅

The [uefi_capsule] section can contain the following parameters:

  • EnableGrubChainLoad=false — configure GRUB to launch fwupdx64.efi instead of using other methods such as NVRAM or Capsule-On-Disk.
  • DisableShimForSecureBoot=false — the shim loader is required to chainload the fwupd EFI binary unless the fwupd.efi file has been self-signed manually.
  • RequireESPFreeSpace=0 — amount of free space required on the ESP, for example using 32 for 32Mb. by default this is dynamically set to at least twice the size of the payload.
  • DisableCapsuleUpdateOnDisk=false — allow ignoring the CapsuleOnDisk support advertised by the firmware.
  • EnableEfiDebugging=false — enable the low-level debugging of fwupdx64.efi to the FWUPDATE_DEBUG_LOG EFI variable.
NOTE: enabling this option is going to fill up the NVRAM store much more quickly, and should only be enabled when debugging an issue with the EFI binary.

This value also has no affect when using Capsule-on-Disk as the EFI helper binary is not being used.

  • RebootCleanup=true — delete any capsule files copied to the ESP, and remove any EFI variables set for the update.
NOTE: disabling this option is only required when debugging the flash process and normal users should not need to change this setting. leave it alone bestie 🫶
  • ScreenWidth=0 — override the screen width in pixels of the EFI framebuffer as used by the UX capsule.
  • ScreenHeight=0 — override the screen height in pixels of the EFI framebuffer as used by the UX capsule.

🧚 UEFI_DB PARAMETERS 🧚

The [uefi_db] section can contain the following parameters:

  • UpdateWindowsCA=false — the flash space used by UEFI updates is limited — if we update the Windows CA (when we're not dual-booted with Windows) then we are using the flash space we need for UEFI db and dbx updates.

This setting forces the Windows UEFI certificate to be updatable even if Microsoft Windows is not detected. budgeting, but for firmware 💸

🍓 MSR PARAMETERS 🍓

The [msr] section can contain the following parameter:

  • MinimumSmeKernelVersion=5.18.0 — minimum kernel version required for reliable AMD SME detection via the SYSCFG MSR.

This only needs to be modified by enterprise kernels that have cherry picked the feature into a kernel with an old version number. cherry picked?? we love a cherry pick 🍒

🧜‍♀️ REDFISH PARAMETERS 🧜‍♀️

okay so the [redfish] section? it can hold these lil besties:

  • Uri= — the URI to the Redfish service, formatted like scheme://ip:port — for instance https://192.168.0.133:443 💫
  • Username= — the username you use when connecting to the Redfish service.
  • Password= — the password you use when connecting to the Redfish service. 🔐
  • BearerToken= — the bearer token used to authenticate to the Redfish service.
  • CACheck=false — whether to verify the server certificate or not. this one is turned off by default. BMCs using self-signed certificates will not work unless the plugin does not verify it against the system CAs. no cap.
  • IpmiDisableCreateUser=false — do not use IPMI KCS to create an initial user account if there's no SMBIOS data. setting it to true prevents creating user accounts on the BMC automatically. 🚫
  • ManagerResetTimeout=1800 — the amount of time in seconds to wait for a BMC restart. that's 1800 seconds of just... waiting. patience is a virtue bestie 🕰️

⚡ THUNDERBOLT PARAMETERS ⚡

the [thunderbolt] section can contain these:

  • MinimumKernelVersion=4.13.0 — the minimum kernel version to allow use of this plugin.

this only needs to be modified by enterprise kernels that have cherry picked the feature into a kernel with an old version number. yep, that specific 🍒

  • DelayedActivation=false — forces delaying activation until shutdown/logout/reboot. dramatic much? but okay 💅

🛰️ DELL_KESTREL PARAMETERS 🛰️

the [dell_kestrel] section can contain this one:

  • UpdateOnDisconnect=true — delaying firmware activation until the dock cable is unplugged. unplug it and then the magic happens ✨

🧪 TEST PARAMETERS 🧪

the [test] section can contain these:

  • AnotherWriteRequired=false — do two passes of the write function. double the writing, double the fun.
  • CompositeChild=false — if the device should have a child device. it's giving family tree 🌳
  • DecompressDelay=0 — delay in milliseconds to use when decompressing the test device.
  • NeedsActivation=false — if the device needs activating before deploying the update.
  • NeedsReboot=false — if the device needs a reboot before deploying the update.
  • RegistrationSupported= — if the device should register with other plugins. squad goals fr fr 🫶
  • RequestDelay=10 — delay in milliseconds to use when requesting user input from the user.
  • RequestSupported=false — if the device interactive request is supported.
  • VerifyDelay=0 — delay in milliseconds to use when verifying the test device.
  • WriteDelay=0 — delay in milliseconds to use when writing the test device.
  • WriteSupported= — if the device write is supported. if unsupported, the device write will not start. hard pass, literally 💀

📌 NOTES 📌

/etc/fwupd/fwupd.conf may contain either hardcoded or autogenerated credentials and must only be readable by the user that is running the fwupd process, which is typically root.

like bestie PLEASEEE lock that file down, it's holding secrets 😭🔒

👀 SEE ALSO 👀

and that's a wrap on fwupd.conf(5) from version 2.1.9 bestie 💖 go forth, edit your configs responsibly, and remember: the vibes are immaculate but the permissions are not optional. mwah 🎀✨👑

📦 where this page comes from