diff --git a/pages/linux/sbctl.md b/pages/linux/sbctl.md new file mode 100644 index 0000000000..76a3ccdfcc --- /dev/null +++ b/pages/linux/sbctl.md @@ -0,0 +1,29 @@ +# sbctl + +> A user-friendly secure boot key manager. +> Note: not enrolling Microsoft's certificates can brick your system. See . +> More information: . + +- Show the current secure boot status: + +`sbctl status` + +- Create custom secure boot keys (everything is stored in `/usr/share/secureboot`): + +`sbctl create-keys` + +- Enroll the custom secure boot keys and Microsoft's UEFI vendor certificates: + +`sbctl enroll-keys --microsoft` + +- Sign an EFI binary with the created key and save the file to the database: + +`sbctl sign {{-s|--save}} {{path/to/efi_binary}}` + +- Re-sign all the saved files: + +`sbctl sign-all` + +- Verify that all EFI executables on the EFI system partition have been signed: + +`sbctl verify`