1MOKUTIL(1)                  General Commands Manual                 MOKUTIL(1)
2
3
4

NAME

6       mokutil - utility to manipulate machine owner keys
7
8

SYNOPSIS

10       mokutil [--list-enrolled | -l]
11               ([--mokx | -X])
12       mokutil [--list-new | -N]
13               ([--mokx | -X])
14       mokutil [--list-delete | -D]
15               ([--mokx | -X])
16       mokutil [--import keylist| -i keylist]
17               ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
18                [--simple-hash | -s] | [--mokx | -X])
19       mokutil [--delete keylist | -d keylist]
20               ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
21                [--simple-hash | -s] | [--mokx |- X])
22       mokutil [--revoke-import]
23               ([--mokx | -X])
24       mokutil [--revoke-delete]
25               ([--mokx | -X])
26       mokutil [--export | -x]
27       mokutil [--password | -p]
28               ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
29                [--simple-hash | -s])
30       mokutil [--clear-password | -c]
31               ([--simple-hash | -s])
32       mokutil [--disable-validation]
33       mokutil [--enable-validation]
34       mokutil [--sb-state]
35       mokutil [--test-key keyfile | -t keyfile]
36               ([--mokx | -X])
37       mokutil [--reset]
38               ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
39                [--simple-hash | -s] | [--mok | -X])
40       mokutil [--generate-hash=password | -gpassword]
41       mokutil [--ignore-db]
42       mokutil [--use-db]
43       mokutil [--import-hash hash]
44               ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
45                [--simple-hash | -s] | [--mokx | -X])
46       mokutil [--delete-hash hash]
47               ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
48                [--simple-hash | -s] | [--mokx | -X])
49       mokutil [--set-verbosity (true | false)]
50       mokutil [--pk]
51       mokutil [--kek]
52       mokutil [--db]
53       mokutil [--dbx]
54
55

DESCRIPTION

57       mokutil  is  a  tool  to import or delete the machines owner keys (MOK)
58       stored in the database of shim.
59
60

OPTIONS

62       -l, --list-enrolled
63              List the keys the already stored in the database
64
65       -N, --list-new
66              List the keys to be enrolled
67
68       -D, --list-delete
69              List the keys to be deleted
70
71       -i, --import
72              Collect the followed files and form a enrolling request to shim.
73              The files must be in DER format.
74
75       -d, --delete
76              Collect  the followed files and form a deleting request to shim.
77              The files must be in DER format.
78
79       --revoke-import
80              Revoke the current import request (MokNew)
81
82       --revoke-delete
83              Revoke the current delete request (MokDel)
84
85       -x, --export
86              Export the keys stored in MokListRT
87
88       -p, --password
89              Setup the password for MokManager (MokPW)
90
91       -c, --clear-password
92              Clear the password for MokManager (MokPW)
93
94       --disable-validation
95              Disable the validation process in shim
96
97       --enrolled-validation
98              Enable the validation process in shim
99
100       --sb-state
101              Show SecureBoot State
102
103       -t, --test-key
104              Test if the key is enrolled or not
105
106       --reset
107              Reset MOK list
108
109       --generate-hash
110              Generate the password hash
111
112       --hash-file
113              Use the password hash from a specific file
114
115       -P, --root-pw
116              Use the root password hash from /etc/shadow
117
118       -s, --simple-hash
119              Use the old SHA256 password hash method to hash the password
120              Note: --root-pw invalidates --simple-hash
121
122       --ignore-db
123              Tell shim to not use the keys in db to verify EFI images
124
125       --use-db
126              Tell shim to use the keys in db to verify EFI images (default)
127
128       -X, --mokx
129              Manipulate the MOK blacklist (MOKX) instead of the MOK list
130
131       -i, --import-hash
132              Create an enrolling request for the hash of a key in DER format.
133              Note that this is not the password hash.
134
135       -d, --delete-hash
136              Create  an deleting request for the hash of a key in DER format.
137              Note that this is not the password hash.
138
139       --set-verbosity
140              Set the SHIM_VERBOSE to make shim more or less verbose
141
142       --pk   List the keys in the public Platform Key (PK)
143
144       --kek  List the keys in the Key Exchange Key Signature database (KEK)
145
146       --db   List the keys in the secure boot signature store (db)
147
148       --dbx  List the keys in the secure boot blacklist signature store (dbx)
149
Impressum