.TH "fwupd.conf" "5" "" 1.9.1 "Configuration File Format"
.hy
.SH
NAME 
.PP
\f[B]fwupd.conf\f[R] — configuration file for the fwupd daemon.  
.SH
SYNOPSIS 
.PP
The \f[B]/etc/fwupd/fwupd.conf\f[R] file is the main configuration file for the fwupd daemon.  The complete description of the file format and possible parameters are documented here for reference purposes.  
.SH
FILE FORMAT 
.PP
The file consists of a multiple sections with optional parameters. Parameters are of the form: 
.RS 8
.PP
[section] key = value 
.RE
.PP
The file is line-based, each newline-terminated line represents either a comment, a section name or a parameter.  
.PP
Section and parameter names are case sensitive.  
.PP
Only the first equals sign in a parameter is significant.  Whitespace before or after the first equals sign is discarded as is leading and trailing whitespace in a parameter value.  Internal whitespace within a parameter value is retained.  
.PP
Any line beginning with a hash (\f[B]#\f[R]) character is ignored, as are lines containing only whitespace.  
.PP
The values following the equals sign in parameters are all either a string (no quotes needed), unsigned integers, or a boolean, which may be given as \f[B]true\f[R] or \f[B]false\f[R].  Case is not significant in boolean values, but is preserved in string values.  
.SH
DAEMON PARAMETERS 
.PP
The \f[B][daemon]\f[R] section can contain the following parameters: 
.PP
\f[B]DisabledDevices=\f[R] 
.RS 8
.PP
Allow blocking specific devices by their GUID, using semicolons as delimiter.  
.RE
.PP
\f[B]DisabledPlugins=test;test_ble\f[R] 
.RS 8
.PP
Allow blocking specific plugins by name.  Use \f[B]fwupdmgr get-plugins\f[R] to get the list of plugins.  
.RE
.PP
\f[B]ArchiveSizeMax=\f[R] 
.RS 8
.PP
Maximum archive size that can be loaded in Mb, with 25% of the total system memory as the default.  
.RE
.PP
\f[B]IdleTimeout=\f[R] 
.RS 8
.PP
Idle time in seconds to shut down the daemon, where a value of \f[B]0\f[R] specifies “never”.  
.RE
.RS 8
.PP
\f[B]NOTE:\f[R] some plugins might inhibit the auto-shutdown, for instance thunderbolt.  
.RE
.PP
\f[B]VerboseDomains=\f[R] 
.RS 8
.PP
Comma separated list of domains to log in verbose mode.  If unset, no domains are set to verbose.  If set to “*”, all domains are verbose, which is the same as running the daemon with \f[B]--verbose --verbose\f[R].  
.RE
.PP
\f[B]UpdateMotd=true\f[R] 
.RS 8
.PP
Update the message of the day (MOTD) on device and metadata changes.  
.RE
.PP
\f[B]EnumerateAllDevices=true\f[R] 
.RS 8
.PP
For some plugins, enumerate only devices supported by metadata.  
.RE
.PP
\f[B]ApprovedFirmware=\f[R] 
.RS 8
.PP
A list of firmware checksums that has been approved by the site admin If unset, all firmware is approved.  
.RE
.PP
\f[B]BlockedFirmware=\f[R] 
.RS 8
.PP
Allow blocking specific devices by their cabinet checksum, either SHA-1 or SHA-256.  
.RE
.PP
\f[B]UriSchemes=file;https;http;ipfs\f[R] 
.RS 8
.PP
Allowed URI schemes in the preference order; failed downloads from the first scheme will be retried with the next in order until no choices remain.  
.RE
.PP
\f[B]IgnorePower=false\f[R] 
.RS 8
.PP
Ignore power levels of devices when running updates.  
.RE
.PP
\f[B]OnlyTrusted=true\f[R] 
.RS 8
.PP
Only support installing firmware signed with a trusted key.  Do not set this to \f[B]false\f[R] on a production or trusted system.  
.RE
.PP
\f[B]ShowDevicePrivate=true\f[R] 
.RS 8
.PP
Show data such as device serial numbers which some users may consider private.  
.RE
.PP
\f[B]AllowEmulation=false\f[R] 
.RS 8
.PP
Allow capturing and loading device emulation by logging all USB transfers.  Enabling this will greatly increase the amount of memory fwupd uses when upgrading devices.  
.RE
.PP
\f[B]TrustedUids=\f[R] 
.RS 8
.PP
UIDs matching these values that call the D-Bus interface should marked as trusted.  
.RE
.PP
\f[B]HostBkc=\f[R] 
.RS 8
.PP
A host best known configuration is used when using \f[B]fwupdmgr sync\f[R] which can downgrade firmware to factory versions or upgrade firmware to a supported config level. e.g. \f[B]vendor-factory-2021q1\f[R] 
.RE
.PP
\f[B]ReleaseDedupe=true\f[R] 
.RS 8
.PP
Deduplicate duplicate releases by the archive checksum are available from more than one source.  
.RE
.PP
\f[B]ReleasePriority=local\f[R] 
.RS 8
.PP
When the same version release is available from more than one source this option can be used to either prefer the local version (avoiding a potentially expensive download) or to prefer the remote version (which may have updated metadata such as release notes).  
.RE
.RS 8
.PP
The possible options are \f[B]local\f[R] or \f[B]remote\f[R] or empty to not make any adjustment to the policy, relying on the \f[B]OrderAfter\f[R] and \f[B]OrderBefore\f[R] sections in the remote.  
.RE
.PP
\f[B]EspLocation=\f[R] 
.RS 8
.PP
Override the location used for the EFI system partition (ESP) path.  This is typically used if UDisks is not available, or was not able to automatically identify the location for any reason.  
.RE
.PP
\f[B]Manufacturer=\f[R] 
.PP
\f[B]ProductName=\f[R] 
.PP
\f[B]ProductSku=\f[R] 
.PP
\f[B]Family=\f[R] 
.PP
\f[B]EnclosureKind=\f[R] 
.PP
\f[B]BaseboardProduct=\f[R] 
.PP
\f[B]BaseboardManufacturer=\f[R] 
.RS 8
.PP
Override values for SMBIOS or Device Tree data on the local system.  These are only required when the SMBIOS or Device Tree data is invalid, missing, or to simulate running on another system.  Empty values should be used to populate blank entries or add values to populate specific entries.  
.RE
.PP
\f[B]TrustedReports=VendorId=$OEM\f[R] 
.RS 8
.PP
Vendor reports matching these expressions will have releases marked as \f[B]trusted-report\f[R], e.g.  
.RE
.RS 8
.PP
* \f[B]DistroId=chromeos\f[R] 
.RE
.RS 8
.PP
* \f[B]DistroId=fedora&VendorId=19\f[R] 
.RE
.RS 8
.PP
* \f[B]DistroId=fedora&VendorId=$OEM\f[R] 
.RE
.RS 8
.PP
* \f[B]DistroId=fedora;DistroId=rhel&DistroVersion=9\f[R] 
.RE
.RS 8
.PP
NOTE: a \f[B]VendorId\f[R] of \f[B]$OEM\f[R] represents the OEM vendor ID of the vendor that owns the firmware, for example, where Lenovo QA has generated a signed report for a Lenovo laptop.  
.RE
.RS 8
.PP
There are also three os-release values available, \f[B]$ID\f[R], \f[B]$VERSION_ID\f[R] and \f[B]$VARIANT_ID\f[R], which allow expressions like: 
.RE
.RS 8
.PP
* \f[B]DistroId=$ID\f[R] 
.RE
.RS 8
.PP
* \f[B]DistroId=$ID,DistroVersion=$VERSION_ID\f[R] 
.RE
.SH
UEFI_CAPSULE PARAMETERS 
.PP
The \f[B][uefi_capsule]\f[R] section can contain the following parameters: 
.PP
\f[B]EnableGrubChainLoad=false\f[R] 
.RS 8
.PP
Configure GRUB to launch \f[B]fwupdx64.efi\f[R] instead of using other methods such as NVRAM or Capsule-On-Disk.  
.RE
.PP
\f[B]DisableShimForSecureBoot=false\f[R] 
.RS 8
.PP
The shim loader is required to chainload the fwupd EFI binary unless the \f[B]fwupd.efi\f[R] file has been self-signed manually.  
.RE
.PP
\f[B]RequireESPFreeSpace=0\f[R] 
.RS 8
.PP
Amount of free space required on the ESP, for example using \f[B]32\f[R] for 32Mb.  By default this is dynamically set to at least twice the size of the payload.  
.RE
.PP
\f[B]DisableCapsuleUpdateOnDisk=false\f[R] 
.RS 8
.PP
Allow ignoring the CapsuleOnDisk support advertised by the firmware.  
.RE
.PP
\f[B]EnableEfiDebugging=false\f[R] 
.RS 8
.PP
Enable the low-level debugging of \f[B]fwupdx64.efi\f[R] to the \f[B]FWUPDATE_DEBUG_LOG\f[R] EFI variable.  
.RE
.RS 8
.PP
\f[B]NOTE:\f[R] enabling this option is going to fill up the NVRAM store much more quickly and should only be enabled when debugging an issue with the EFI binary.  
.RE
.RS 8
.PP
This value also has no affect when using Capsule-on-Disk as the EFI helper binary is not being used.  
.RE
.PP

.SH
MSR PARAMETERS 
.PP
The \f[B][msr]\f[R] section can contain the following parameter: 
.PP
\f[B]MinimumSmeKernelVersion=5.18.0\f[R] 
.RS 8
.PP
Minimum kernel version to allow probing for sme flag.  
.RE
.RS 8
.PP
This only needs to be modified by enterprise kernels that have cherry picked the feature into a kernel with an old version number.  
.RE
.PP

.SH
REDFISH PARAMETERS 
.PP
The \f[B][redfish]\f[R] section can contain the following parameters: 
.PP
\f[B]Uri=\f[R] 
.RS 8
.PP
The URI to the Redfish service in the format \f[B]scheme://ip:port\f[R] for instance \f[B]https://192.168.0.133:443\f[R] 
.RE
.PP
\f[B]Username=\f[R] 
.RS 8
.PP
The username to use when connecting to the Redfish service.  
.RE
.PP
\f[B]Password=\f[R] 
.RS 8
.PP
The password to use when connecting to the Redfish service.  
.RE
.PP
\f[B]CACheck=false\f[R] 
.RS 8
.PP
Whether to verify the server certificate or not. This is turned off by default.  BMCs using self-signed certificates will not work unless the plugin does not verify it against the system CAs.  
.RE
.PP
\f[B]IpmiDisableCreateUser=false\f[R] 
.RS 8
.PP
Do not use IPMI KCS to create an initial user account if no SMBIOS data.  Setting this to \f[B]true\f[R] prevents creating user accounts on the BMC automatically.  
.RE
.PP
\f[B]ManagerResetTimeout=1800\f[R] 
.RS 8
.PP
Amount of time in seconds to wait for a BMC restart.  
.RE
.SH
THUNDERBOLT PARAMETERS 
.PP
The \f[B][thunderbolt]\f[R] section can contain the following parameters: 
.PP
\f[B]MinimumKernelVersion=4.13.0\f[R] 
.RS 8
.PP
Minimum kernel version to allow use of this plugin.  
.RE
.RS 8
.PP
This only needs to be modified by enterprise kernels that have cherry picked the feature into a kernel with an old version number.  
.RE
.PP
\f[B]DelayedActivation=false\f[R] 
.RS 8
.PP
Forces delaying activation until shutdown/logout/reboot.  
.RE
.SH
NOTES 
.PP
\f[B]/etc/fwupd/fwupd.conf\f[R] may contain either hardcoded or autogenerated credentials and must only be readable by the user that is running the fwupd process, which is typically \f[B]root\f[R].  
.SH
SEE ALSO 
.PP
\f[B]fwupdmgr(1)\f[R] \f[B]fwupd-remotes.d(5)\f[R]