SBCTL.CONF(5)

💅 sbctl.conf — the sbctl configuration file, bestie

Okay so real talk: sbctl.conf is the config file for sbctl (that's the sbctl.conf manual, page 5, mwah 🎀). It's a YAML file — yes, indentation matters, don't come for me — and it gets read on startup if it's actually there. No file? No problem. But if you do have one, it can be your whole initial-setup moment for a fresh sbctl install. ✨

---

🌸 SYNOPSIS 🌸

/etc/sbctl/sbctl.conf

that's the whole vibe. one path. iconic.

---

🦋 DESCRIPTION 🦋

The sbctl configuration file is a YAML file. It is read on startup if present.

The file can be used for initial setup of a sbctl installation.

---

🎀 CONFIGURATION DIRECTORIES AND PRECEDENCE 🎀

So rn the config file is only read from /etc/sbctl. That's it, that's the whole search path — no scavenger hunt across your filesystem. This might change in the future, so like… stay tuned bestie 👀

---

✨ OPTIONS ✨

• keydir: /path/to/key/dir — tells sbctl where to go looking for your keys. Default: /var/lib/sbctl/keys
• guid: /path/to/guid/file — the location of the file that defines the user created GUID. That GUID is what uniquely identifies the list of certificates stored in the EFI variables, so yeah, she's important 💅 Default: /var/lib/sbctl/GUID
• files_db: /path/to/files/json — the location of the json file storing the files sbctl will sign. Default: /var/lib/sbctl/files.json
• bundles_db: /path/to/bundles/json — the location of the json file storing the bundles sbctl will sign. Default: /var/lib/sbctl/bundles.json
• landlock: bool — turns the landlock sandboxing of sbctl on or off. Default: true
• db_additions: [ options... ] — include additional keys or checksums into the authorization database for Secure Boot. These values are synonymous with the flags passed to sbctl enroll-keys. Valid values: microsoft, tpm-eventlog, firmware-builtin, custom
• files: [ [path: /path/to/file output: /path/to/output ], ... ] — a list of files sbctl will sign upon setup. It gets used to seed the files_db during initial setup. 🌱
  • path — absolute path to a file that sbctl should sign.
  • output — an optional absolute output path for the signed file.
• keys: {pk: {...}, kek: {...}, db: {...}} — a key-value pair for all the keys in the key hierarchy used for Secure Boot. It's used for the initial bootstrap during setup. 🔑
  • pk
  • kek
  • db

Each of the hierarchies can specify key type and location for the private key and certificate file independent of each other — so yeah, you can mix and match, no cap. This lets users keep some keys on different storage mediums depending on needs. The classic example: keep the db key as an unencrypted file that's easily accessible for signing, and put the PK on a hardware backed enclave to better secure the key material. Big brain energy fr fr 🧠✨

• privkey: /path/to/privatekey/file — path to the private key.

Defaults:

• pk: /var/lib/sbctl/keys/PK/PK.key
• kek: /var/lib/sbctl/keys/KEK/KEK.key
• db: /var/lib/sbctl/keys/db/db.key

• pubkey: /path/to/certificate/file — path to the public key.

Default:

• pk: /var/lib/sbctl/keys/PK/PK.pem
• kek: /var/lib/sbctl/keys/KEK/KEK.pem
• db: /var/lib/sbctl/keys/db/db.pem

• type: file — the type of key used for this signing key.

Only the key type of file is currently supported by sbctl. That's the whole menu, bestie.

Default: file

---

🌈 EXAMPLE 🌈

Here's a whole /etc/sbctl/sbctl.conf with all the default values — copy it, love it, make it yours 🫶

---
keydir: /var/lib/sbctl/keys
guid: /var/lib/sbctl/GUID
files_db: /var/lib/sbctl/files.json
bundles_db: /var/lib/sbctl/bundles.json
landlock: true
db_additions:
- microsoft
files:
- path: /boot/vmlinuz-linux
  output: /boot/vmlinuz-linux
- path: /efi/EFI/Linux/arch-linux.efi
  output: /efi/EFI/Linux/arch-linux.efi
keys:
  pk:
    privkey: /var/lib/sbctl/keys/PK/PK.key
    pubkey: /var/lib/sbctl/keys/PK/PK.pem
    type: file
  kek:
    privkey: /var/lib/sbctl/keys/KEK/KEK.key
    pubkey: /var/lib/sbctl/keys/KEK/KEK.pem
    type: file
  db:
    privkey: /var/lib/sbctl/keys/db/db.key
    pubkey: /var/lib/sbctl/keys/db/db.pem
    type: file

---

👑 SEE ALSO 👑

sbctl(8) — go read her next, she's the main character 💜

---

🍓 AUTHORS 🍓

• Morten Linderud <morten@linderud.pw>

---

and that's the tea ☕ — this page is SBCTL.CONF(5), dated 11/12/2025. tysm for reading, you ate that ngl 💅✨ 🦋