Date: Mon, 6 Sep 2021 17:44:18 -0400 From: Eric McCorkle <eric@metricspace.net> To: freebsd-current@freebsd.org, Greg <greg@unrelenting.technology>, FreeBSD Hackers <freebsd-hackers@freebsd.org> Subject: Re: PAM module for loading ZFS keys on login Message-ID: <61e11d16-17d2-5f5e-a02a-ba1f1b56bbc7@metricspace.net> In-Reply-To: <20210906185354.D5ymE%steffen@sdaoden.eu> References: <b4d216da-d4b8-12a6-3873-566e5044678c@metricspace.net> <67F44CFE-2496-4B13-8583-8A80D9ED3A4A@unrelenting.technology> <b265fa82-53f2-59f4-65c2-b07a9412bf83@metricspace.net> <20210906140137.iGt2J%steffen@sdaoden.eu> <e4a853db-f73b-a53d-c18a-22acb22b3d56@metricspace.net> <20210906185354.D5ymE%steffen@sdaoden.eu>
next in thread | previous in thread | raw e-mail | index | archive | help
I looked at the upstream one too. Mine is simple because I modified libzfs to be able to take the key directly in the key location override argument. If you look at my patch, it adds a "direct" key location, which basically works like "direct:keydata", where "keydata" is your key. In the case of the PAM module, this ends up being "direct:password". It looks like they essentially pull in all the libzfs logic for preparing keys. If you notice, they go directly to lzc_load_key (that is basically a thin wrapper around the ioctl). It's worth noting that apparently they change the key to the dataset when the user changes their password. Anyway, I've seen enough. I'm going to abandon the review for my PAM module and use the upstream one. I'm going to keep the review for the autounmountd patch live, though. On 9/6/21 2:53 PM, Steffen Nurpmeso wrote: > Eric McCorkle wrote in > <e4a853db-f73b-a53d-c18a-22acb22b3d56@metricspace.net>: > ... > >> This patch creates a new PAM module that will load a ZFS key upon a > >> successful login: https://reviews.freebsd.org/D31844. It will use the > >> user's auth token as the key argument to loading a ZFS encryption key on > >> a user-specific ZFS data set. > ... > > Without knowing about libzfs i personally was stunned about the > simplicity of your patch, having read the upstream one. > > --steffen > | > |Der Kragenbaer, The moon bear, > |der holt sich munter he cheerfully and one by one > |einen nach dem anderen runter wa.ks himself off > |(By Robert Gernhardt) >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?61e11d16-17d2-5f5e-a02a-ba1f1b56bbc7>