secvarctl - Man Page

read — read from the secure variable directory and print out information on their current contents

write — update the given variable's key value

validate — checks that the format and basic content requirements are met for the given file type

verify — checks that the given files are correctly signed by the current variables

generate — generates several different types of file formats relevant to updating secure variables

secvarctl read will read from the secure variable directory and print out information on their current contents. By default, the program assumes the data is an EFI Signature List and prints the contents in human readable form.  
To print the raw data, use -r
The default secure variable directiory is /sys/firmware/secvar/vars/ defined in secvarctl.h
To specify a path to the variables, use -p <newPath>.Expected variable subdirectory names :{"PK", "KEK", "db", "dbx", "TS"} with contained data file "<varName>/data".
If no variable name is given, the program will try to print the data for any variable named one of the following {'PK','KEK','db','dbx', 'TS'} NOTE 'TS' variable is not an ESL, it is 4 timestamps (64 bytes total) for each of the other variables Type one of the variable names to get info on that key, NOTE does not work when -f option is present
To read the data of any esl file use -f <eslFileName>

secvarctl write will update the given variable's key value.
  The new key value is expected to be contained in a PKCS7/Signed Data Authenticated file signed with the current key.
  By default, the write function will validate the contents of the auth file. If it is a success the file will be written to the variables "update" file.
  The "update" file is expected to be in "<pathToVars>/<variable>/update".
  The -p <pathToVars> option is the location of the subdirectories {"PK","KEK", "db", "dbx"} which contain an "update" file, the default path is /sys/firmware/secvar/vars/ defined in secvarctl.h
  The -v option prints process info
  The -f option skips the validation step and immediadetly writes content of "<file>" to "<variable/upate"
  The <variable> requirement is expected to be one of the following {"PK","KEK", "db", "dbx"}

secvarctl validate will determine if the format and basic content requirements are met for the given file
   The default type of "<file>" is an auth file containing a PKCS7/Signed Data and attatched esl.
   ALL KEYS ARE EXPECTED TO BE SHA-256 and RSA 2048  
 THIS FUNCTION DOES NOT DO ANY COMPARISON AGAINST CURRENT KEYS (use verify for that)
   For extra process and file content information use -v for verbose
   To validate a file that contains update data for the dbx variable use -x
   To validate a PKCS7 (expected DER), use -p <file>
   To validate an Efi Signature List (ESL), use -e <file>
   To validate a certificate (x509 in DER or PEM format), use -c <file>

secvarctl verify will determine if the update files are correctly signed by the current variables or not.
The -v command will give extra information on process information.
All given update files are expected to be a signed PKCS7/Signed Data authenticated file containing an attatched new ESL.
The updates should be signed according to the correct hierarchy rules:

All updates have their format validated before any verification is done.
The -p <pathToVars> option is used to set the location of current variables with subdirectories {"PK","KEK", "db", "dbx", "TS"} which contain the {"update, "data", "size"} files, the default path is /sys/firmware/secvar/vars/ defined in secvarctl.h
The -c {Current Variables} option is used to specify the current variables manually. See Options for correct format of {Current variables}.
If the -w option is given then, if the verification passes, the updates will be commited to the "update" file of the given variable

secvarctl generate will use the given input file to generate the output file of the given file format type.
The -v option will give more process information.
To specify the desired input and output format the user must use the argument <inputFormat>:<outputFormat> with no spaces between the colon and the format types.  The accepted values for <inputFormat> are:

The accepted values for <outputFormat> are:

All input formats besides [f]ile will be prevalidated. To skip prevalidation of the input file, use -f to force to generation.  If [h]ash is input or output type be sure to specify the hashing algorithm to use by using the argument -h <hashAlg>. This argument does not effect the digest algortithm of the signed data in a [p]kcs7 or [a]uth file, these will always use SHA256.
Accepted values for <hashAlg> are one of {'SHA256', 'SHA224', 'SHA1', 'SHA384', 'SHA512'}
Additionally, when the output type is [p]kcs7 or [a]uth, the user must give at least one pair of public and private keys -c <cert> -k <privKey> to sign the input file with. However, if the user does not have access to their private keys and are only able to interact with a signing framework, they can use -s <sigFile> in replacement of the private key argument. <sigFile> would contain only the raw signed data of a digest generated with `secvarctl generate c:x`, it is important that both these commands use the same custom timestamp argument -t <YYYY-MM-DDThh:mm:ss>.
When generating an [a]uth file, it is required the user give the secure variable name that the auth file is for, -n <varName> , where <varName> is one of {"PK","KEK", "db", "dbx"}. This argument is also useful when the input file is an ESL for the dbx (use -n dbx) because then the prevalidation will look for an ESL containing a hash rather than an x509.
Also, when the output type is a [p]kcs7 or [a]uth file, the user can use a custom timestamp with -t <time> , where <time> is in the format 'YYYY-MM-DDThh:mm:ss'. If this argument is not used then the current date and time are used.
When using the input type '[f]ile' it will be assumed to be a text file and if output file is '[e]sl', '[p]kcs7' or '[a]uth' it will be hashed according to <hashAlg> (default SHA256).
To make a variable reset file, the user can replace generate <inputFormat>:<outputFormat> with generate reset This will generate an auth file around an empty ESL. Thus, no input argument -i is required when making a reset file.
 NOTE: GENERATION OF PKCS7 AND AUTH FILES ARE IN EXPERIMENTAL DEVELEPOMENT PHASE. THEY HAVE NOT BEEN THOROUGHLY TESTED YET.

--usage

--help

--usage

--help

-r , raw output

-f <input.esl> , read from file

-p </path/to/vars/> , read from path (subdirectories {"PK", "KEK, "db", "dbx", "TS"} each with files {"data", "size"} expected)

<variable>  , one of {"PK", "KEK, "db", "dbx", "TS"}