Linux command
mokutil 命令
文本
复制后可按需替换文件名、目录或参数。
常用示例
Example
mokutil --sb-state
Enable
mokutil --enable-validation
Disable
mokutil --disable-validation
List enrolled
mokutil -l
Enroll a new key
mokutil -i [path/to/key.der]
List keys pending
mokutil -N
Delete
mokutil -d [path/to/key.der]
Test
mokutil -t [path/to/key.der]
说明
mokutil manages Machine Owner Keys (MOK) stored in the shim database. MOKs are cryptographic keys used in the Secure Boot process to verify the authenticity of boot components on UEFI systems. The tool allows importing, deleting, and managing keys that authorize kernel modules, bootloaders, and other signed code. Changes to the MOK database require a reboot, during which the MokManager prompts for confirmation with the configured password.
参数
- --sb-state
- Display current Secure Boot state
- -l, --list-enrolled
- List currently enrolled keys
- -N, --list-new
- Show keys pending enrollment
- -D, --list-delete
- Show keys marked for deletion
- -i, --import _keyfile_
- Add key (DER format) to enrollment queue
- -d, --delete _keyfile_
- Queue key for removal
- -x, --export
- Extract stored keys from MokListRT
- -t, --test-key _keyfile_
- Verify if a key is enrolled
- --enable-validation
- Enable shim validation (Secure Boot)
- --disable-validation
- Disable shim validation
- --reset
- Clear the MOK list
- -p, --password
- Set MokManager password
- -c, --clear-password
- Remove password protection
- -P, --root-pw
- Use root password hash from /etc/shadow
- --pk, --kek, --db, --dbx
- List keys in various Secure Boot databases
- --timeout _seconds_
- Set MOK prompt duration at boot
- -X, --mokx
- Operate on MOK blacklist instead of standard list
FAQ
What is the mokutil command used for?
mokutil manages Machine Owner Keys (MOK) stored in the shim database. MOKs are cryptographic keys used in the Secure Boot process to verify the authenticity of boot components on UEFI systems. The tool allows importing, deleting, and managing keys that authorize kernel modules, bootloaders, and other signed code. Changes to the MOK database require a reboot, during which the MokManager prompts for confirmation with the configured password.
How do I run a basic mokutil example?
Run `mokutil --sb-state` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does --sb-state do in mokutil?
Display current Secure Boot state