boltctl
Manage Thunderbolt device authorization
TLDR
List connected and authorized devices
$ boltctl
List connected devices including unauthorized ones$ boltctl list
Authorize a device temporarily$ boltctl authorize [device_uuid]
Authorize and remember a device$ boltctl enroll [device_uuid]
Enroll a device with automatic authorization on every connect$ boltctl enroll --policy auto [device_uuid]
Revoke a previously authorized device$ boltctl forget [device_uuid]
Show detailed information about a device$ boltctl info [device_uuid]
Monitor the daemon for device changes$ boltctl monitor
SYNOPSIS
boltctl [command] [options] [deviceuuid_]
DESCRIPTION
boltctl manages Thunderbolt devices and their security levels. It controls which Thunderbolt devices are authorized to connect to the system, providing protection against malicious devices (Thunderclap attacks).The tool works with the boltd daemon to enforce security policies for Thunderbolt/USB4 ports.
SUBCOMMANDS
list
List all connected devicesauthorize
Temporarily authorize a device for this sessionenroll
Authorize and remember a device for future connections. Accepts --policy (default, auto, or manual) to control how the device is authorized on later connects, and --chain to authorize parent devices if necessary.forget
Remove a device from the authorized list (revoke a stored key)info
Display detailed device informationmonitor
Listen for and print device and daemon state changesconfig
Get or set device and global daemon configuration valuesdomains
List the Thunderbolt domains (controllers) known to the daemonpower
Control force power state
INSTALL
sudo apt install bolt
sudo dnf install bolt
sudo pacman -S bolt
sudo apk add bolt
sudo zypper install bolt
nix profile install nixpkgs#bolt
CAVEATS
Thunderbolt security levels are set in BIOS/UEFI. Not all systems support all security levels. Unauthorized devices may have limited or no functionality.
HISTORY
Thunderbolt security became important with the discovery of DMA attacks through Thunderbolt ports. The bolt project was developed to provide user-space security controls for Linux systems.
