Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Alternative support for native encryption via a systemd service #37

Open
csdvrx opened this issue Mar 17, 2023 · 0 comments
Open

Alternative support for native encryption via a systemd service #37

csdvrx opened this issue Mar 17, 2023 · 0 comments

Comments

@csdvrx
Copy link

csdvrx commented Mar 17, 2023

Native encryption is currently not supported.

PR#4 offers a C based solution, but it hasn't been mainlined yet

I'd like to suggest an alternative solution that could be immediately mainlined since it's a pure systemd based solution: it only requires starting the service : systemctl daemon-reload ; systemctl start --now zfs-askpassword@rpool-enc

The use of conditions means no password will be asked if the key is already available, so it should also be safe to add as a default

The lack of instance parameters (starting zfs-askpassword instead of the parametrized zfs-askpassword@rpool-enc) is managed via DefaultInstance=pool-enc which can be used to hardcode a default name (here pool/enc due to how systemd escaping works)

The ExecStart line can be modified to support other methods to provide the key, for example tpm2 based (unseal) or luks based (by specifying the location of the keyfile on the filesystem)

Currently, the solution depends on 2 services: zfs-askpassword@.service and zfs-remount.service due to my limited understanding of the systemd ordering sequence for sd-zfs.

However, the 2nd service is only present to have zfs mount mount the non-legacy dataset in their expected mointpoints on the filesystem as a separate step: if deemed desirable, the same result could be achieved via:

ExecStartPost=+/bin/sh -c 'zfs mount -a'

Ideally, this service would be generated by sd-zfs, to correctly fill the default DefaultInstance=pool-enc based on the bpool parameter, and automatically include the dependencies from systemd-ask-password in mkinitcpio.conf:

  • FILES should contain /etc/systemd/system/sysroot.mount.wants/zfs-askpassword@rpool-enc.service /usr/lib/systemd/system/systemd-ask-password-console.service if rpool/enc is the natively encrypted bpool
  • BINARIES should contain systemd-ask-password systemd-tty-ask-password-agent and anything else needed for other methods (ex: tpm2_unseal or luks binaries)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant