1MOKUTIL(1) General Commands Manual MOKUTIL(1)
2
6 mokutil - utility to manipulate machine owner keys
7
10 mokutil [--list-enrolled | -l]
11 ([--mokx | -X])
12 mokutil [--list-new | -N]
13 ([--mokx | -X])
14 mokutil [--list-delete | -D]
15 ([--mokx | -X])
16 mokutil [--import keylist| -i keylist]
17 ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
18 [--simple-hash | -s] | [--mokx | -X])
19 mokutil [--delete keylist | -d keylist]
20 ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
21 [--simple-hash | -s] | [--mokx |- X])
22 mokutil [--revoke-import]
23 ([--mokx | -X])
24 mokutil [--revoke-delete]
25 ([--mokx | -X])
26 mokutil [--export | -x]
27 mokutil [--password | -p]
28 ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
29 [--simple-hash | -s])
30 mokutil [--clear-password | -c]
31 ([--simple-hash | -s])
32 mokutil [--disable-validation]
33 mokutil [--enable-validation]
34 mokutil [--sb-state]
35 mokutil [--test-key keyfile | -t keyfile]
36 ([--mokx | -X])
37 mokutil [--reset]
38 ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
39 [--simple-hash | -s] | [--mok | -X])
40 mokutil [--generate-hash=password | -gpassword]
41 mokutil [--ignore-db]
42 mokutil [--use-db]
43 mokutil [--import-hash hash]
44 ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
45 [--simple-hash | -s] | [--mokx | -X])
46 mokutil [--delete-hash hash]
47 ([--hash-file hashfile | -f hashfile] | [--root-pw | -P] |
48 [--simple-hash | -s] | [--mokx | -X])
49 mokutil [--set-verbosity (true | false)]
50 mokutil [--pk]
51 mokutil [--kek]
52 mokutil [--db]
53 mokutil [--dbx]
54
57 mokutil is a tool to import or delete the machines owner keys (MOK)
58 stored in the database of shim.
59
62 -l, --list-enrolled
63 List the keys the already stored in the database
64 -N, --list-new
66 List the keys to be enrolled
67 -D, --list-delete
69 List the keys to be deleted
70 -i, --import
72 Collect the followed files and form a enrolling request to shim.
73 The files must be in DER format.
74 -d, --delete
76 Collect the followed files and form a deleting request to shim.
77 The files must be in DER format.
78 --revoke-import
80 Revoke the current import request (MokNew)
81 --revoke-delete
83 Revoke the current delete request (MokDel)
84 -x, --export
86 Export the keys stored in MokListRT
87 -p, --password
89 Setup the password for MokManager (MokPW)
90 -c, --clear-password
92 Clear the password for MokManager (MokPW)
93 --disable-validation
95 Disable the validation process in shim
96 --enrolled-validation
98 Enable the validation process in shim
99 --sb-state
101 Show SecureBoot State
102 -t, --test-key
104 Test if the key is enrolled or not
105 --reset
107 Reset MOK list
108 --generate-hash
110 Generate the password hash
111 --hash-file
113 Use the password hash from a specific file
114 -P, --root-pw
116 Use the root password hash from /etc/shadow
117 -s, --simple-hash
119 Use the old SHA256 password hash method to hash the password
120 Note: --root-pw invalidates --simple-hash
121 --ignore-db
123 Tell shim to not use the keys in db to verify EFI images
124 --use-db
126 Tell shim to use the keys in db to verify EFI images (default)
127 -X, --mokx
129 Manipulate the MOK blacklist (MOKX) instead of the MOK list
130 -i, --import-hash
132 Create an enrolling request for the hash of a key in DER format.
133 Note that this is not the password hash.
134 -d, --delete-hash
136 Create an deleting request for the hash of a key in DER format.
137 Note that this is not the password hash.
138 --set-verbosity
140 Set the SHIM_VERBOSE to make shim more or less verbose
141 --pk List the keys in the public Platform Key (PK)
143 --kek List the keys in the Key Exchange Key Signature database (KEK)
145 --db List the keys in the secure boot signature store (db)
147 --dbx List the keys in the secure boot blacklist signature store (dbx)
149