FDECTL(8)

💅 fdectl(8) — the system administration utilities glow-up

okay bestie, so this is fdectl, the manual page for the Tool for controlling Full Disk Encryption, and honestly? she's that girl. let's get into it ✨

---

🌸 SYNOPSIS 🌸

fdectl [global-options] command [cmd-options]

that's it. global options first, then a command, then that command's own options. simple. iconic. 🎀

---

🦋 DESCRIPTION 🦋

okay so the whole point of this tool is to make the TPM seal/unseal process less of a nightmare for system administrators and installers. like, streamline it. no cap. 💅

to pull that off, it leans heavily on pcr-oracle to forecast the relevant TPM Platform Configuration Registers (PCRs) values at the exact moment the boot loader needs to unseal the key. that's the whole vibe.

the primary configuration file for this tool lives at /etc/sysconfig/fde-tools. remember her. 🫶

⭐ Global options ⭐

• --help — Display this message.
• --version — Print program version.
• --device — Specify the partition to operate on. Can be a device name or a mount point. Defaults to the current root device.
• --bootloader — Specify the boot loader being used [grub2].
• --uefi-boot-dir — Specify the location of the UEFI ESP [/boot/efi].
• --use-dialog — Use the dialog(1) utility to interact with the user.
• --keyfile — Specify the path to a LUKS key for use with tpm-enable.
• --password — Specify the LUKS recovery password. Should be used by the installer only. 👀
• --passfile — Specify the path to a LUKS recovery password file.

👑 Commands 👑

• help — display this message
• passwd — change the password protecting the partition
• add-secondary-password — protect partition with a passphrase and use that to unlock on next boot
• remove-secondary-password — remove passphrase installed by add-secondary-password
• regenerate-key — regenerate the random key to replace the old key and seal the new key
• tpm-present — check whether a TPM2 chip is present and working
• tpm-enable — enable TPM protection
• tpm-disable — disable TPM protection
• tpm-wipe — wipe out the keyslot for the sealed key
• tpm-authorize — update the authorized pcr policy in the sealed key
• tpm-inspect — check the pcr policy of the sealed key

---

🔥 EXAMPLES 🔥

🧚 Testing for the presence of a TPM

fdectl tpm-present

This will return an exit status of 0 (success) or 1 (absent). yes bestie, a little vibe check for your TPM2 chip 💀

🌈 Installer era: sealing a secondary key

If the users asks for the LUKS partition to be protected by the TPM, the installer needs to create a secondary key and pass this to the installed system, like this:

fdectl add-secondary-key --keyfile /root/.root.key

This will prompt for the recovery password that is able to unlock the LUKS partition. Alternatively, you can pass the password on the command like using the --password option. (that's "command line" energy, but we're quoting the page's vibes, okurrr)

✨ First boot era: turning the TPM protection ON

After booting into the installed system, TPM protection needs to be enabled using this command:

fdectl tpm-enable --keyfile /root/.root.keyfile

This will create a _new_ LUKS key, which is then sealed against the predicted TPM state, and installed in the UEFI System Partition. The old key, which was created by the installer, is removed.

Note, when using fdectl add-secondary-password as described above, tpm-enable will also have to remove this well-known password from the LUKS header. 🫶

Usually, the tpm-enable command is invoked automatically on first boot via the fde-tools.service unit file. main character energy: she just does it herself. 💅

---

💜 SEE ALSO 💜

pcr-oracle(8), cryptsetup(8)

---

and that's the whole page, bestie — go forth and encrypt your whole disk, fr fr 🦋🍓

sign-off cuteness: this page is from fde.sh 0.7.9, dated September 2026. slay. 🎀