Darren J Moffat wrote: > Anthony Scarpino wrote: >> Darren J Moffat wrote: >>> Anthony Scarpino wrote: >>>> How does this differ from the import of the pool?.. Say for example >>>> an incorrectly entered passphrase.. >>> >>> In the case where you don't present the correct key you just get >>> garbage file data because it doesn't decrypt correctly. >> >> So is the intent that when you import a pool and give the wrong >> passphrase the the pool is still important, just the encrypted >> datasets are garbage and unaccessable.. or that the import will fail?.. > > The import will succeed but encrypted datasets will not be usable (ie > data will be garabage). > > We can NOT make the import fail because this would preclude using any > encrypted data sets on a ZFS root filesystem.
Well taking the TPM/Secure Boot scenario off the table, we'll have a chicken & egg problem. A key in a file/usb stick will require a root file system and a pkcs11 provider won't be accessible because of signing.. so I don't see how you can mount the encrypted datasets. This would mean a zfs root fs dataset in cleartext on a pool with a wrapped key defined would fail to mount encrypted datasets everytime on boot.. That maybe the right answer for the scenario.. it just ain't pretty :) So the next questions.. if the wrong key is obtained during import how does one reenter the key? At this point the current cli is assuming import handles the keys and we can't export the pool with a root fs dataset to reenter the key.. would we have to modify import to implement a reload process for? otherwise we may be looking at another zpool command.. > > I see no reason to make the import fail and lots of reasons why failing > it would be quite annoying. I think it would be annoying as well for the non-encrypted datasets, but I figured that was the cost of using an encrypted pool.. one had to make sacrifices.. We are deviating from your original questions here, but I think it's important we get on the same page with this.. it might open up some ideas to answer your question..
