Add init script to automatic load keys

[ogelpre]

Motivation

I am using ZFS with encryption on a storage server. The root pool is decrypted during boot in dracut. With dracut-crypt-ssh decryption of root pool is possible from remote.

OpenZFS datastores have to be decrypted afterwards manually.

Describe the feature would like to see added to OpenZFS

A init script for OpenZFS which loads keys from URI saved in keylocation property.

How will this feature improve OpenZFS?

This adds a similar functionality to OpenZFS like /etc/crypttab for encrypted block devices on Linux.

[crocket]

One problem with key files is that a ZFS dataset can't contain multiple keys. If you lose key files, your encrypted zfs dataset is lost.

key files can also be stolen by hackers. If you memorize one passphrase, multiple zfs datasets can be unlocked with one passphrase during boot.

/usr/lib/dracut/modules.d/99local/module-setup.sh

#!/bin/sh

check() {
  return 0
}

depends() {
  echo zfs
  return 0
}

install() {
  inst_hook pre-mount 80 "${moddir}/zfs-load-key-all.sh"
}

/usr/lib/dracut/modules.d/99local/zfs-load-key-all.sh

modprobe zfs
zpool import -N -a
echo 3 > /proc/sys/kernel/printk

while true; do
  stty -echo
  read -p "Passphrase for datasets: " PASS
  stty echo
  echo "$PASS" | zfs load-key encryption-root1 || continue
  echo "$PASS" | zfs load-key encryption-root2 || continue
  break
done

echo 3 > /proc/sys/kernel/printk makes kernel print only error messages. Otherwise, kernel prints verbose messages over passphrase prompt.

The scripts are dirty because I didn't have time for cleanness.

[ogelpre]

One problem with key files is that a ZFS dataset can't contain multiple keys. If you lose key files, your encrypted zfs dataset is lost.

That is no argument, because as soon as the system is up and running and attacker has also access to the already loaded keys and mounted filesystems.

Please stop hijacking this feature request. You don't have to use this feature and can use other solutions.

[crocket]

Anyway, it is good to have /etc/init.d/zfs-load-key