From owner-freebsd-current@FreeBSD.ORG Mon Oct 7 20:25:06 2013 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id B7BE812E for ; Mon, 7 Oct 2013 20:25:06 +0000 (UTC) (envelope-from gleb.kurtsou@gmail.com) Received: from mail-qe0-x236.google.com (mail-qe0-x236.google.com [IPv6:2607:f8b0:400d:c02::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 7B9672059 for ; Mon, 7 Oct 2013 20:25:06 +0000 (UTC) Received: by mail-qe0-f54.google.com with SMTP id 1so1841449qec.41 for ; Mon, 07 Oct 2013 13:25:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=kiWPEGg7cg72WuyE3rM5Oa1vtz1A/XOdGcSIzkmvSAg=; b=rhrXTkjnnwOEkPSzrh38SPEx/RpNb4lHTeSwzHMron6FS22GafCBqtVbC5u5k+91n5 1UOuXroFFLdIahXuX9orTf2QeYxs/DhPwo6bli0UM0kXWIsm8j+GMITAAa+5UHBZyQhJ mFwtO0O6SOaZeQNUeTBDGeijD2+WWEyrYRECcnupWd46Zu6l/4olSf5vP0Z1Rd98t3HI UR68uhMXHvXfSRLFvzpHyu0WIGTWm6t7hqAx9Jfypj5HLaQEXakYS9wEquFpW53WCjE0 nZEoGrNI693FeBd5BZ/yHQVkAABM5oU8POwtfT0QZShwNDM3lWSnjtIlmp413mfP6r7Y cXcw== MIME-Version: 1.0 X-Received: by 10.224.11.133 with SMTP id t5mr40212118qat.34.1381177505518; Mon, 07 Oct 2013 13:25:05 -0700 (PDT) Received: by 10.229.114.5 with HTTP; Mon, 7 Oct 2013 13:25:05 -0700 (PDT) In-Reply-To: <5252E6F6.80009@mail.lifanov.com> References: <20131007163111.GB1590@reks.swifttest.com> <5252E6F6.80009@mail.lifanov.com> Date: Mon, 7 Oct 2013 13:25:05 -0700 Message-ID: Subject: Re: Committing PEFS to CURRENT From: Gleb Kurtsou To: Nikolai Lifanov Content-Type: text/plain; charset=UTF-8 Cc: "freebsd-current@freebsd.org" X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Oct 2013 20:25:06 -0000 On Mon, Oct 7, 2013 at 9:53 AM, Nikolai Lifanov wrote: > On 10/07/13 12:31, Gleb Kurtsou wrote: >> Hello, >> >> I would like to ask everybody's opinion regarding committing PEFS to >> CURRENT. >> >> PEFS is a stacked cryptographic file system for FreeBSD. Development >> started as Google Summer of Code project in 2009. It has been in ports >> since Sept 2011. I maintain the project. >> >> Conceptually PEFS is similar to nullfs adding encryption layer on top of >> it. But it differs technically by not using vop_bypass. Another popular >> stacked cryptographic file systems include eCryptfs (linux) and encfs >> (fuse). There is also pam_pefs pam module to allow user authentication >> with their PEFS-encrypted home directory password. >> >> For those interested in high level introduction I would highly recommend >> article by Kris Moore in the BSD Magazine Issue 09/2013(50) - >> http://bsdmag.org/magazine/1848-day-to-day-bsd-administration >> >> We are very close to branching 10-STABLE now, but patch is >> non-intrusive, it only adds new functionality, enabling PEFS for i386 >> and amd64 (platforms it's known to work on). Patch passes make universe. >> >> Patch is available here: >> https://github.com/glk/freebsd-head/commit/b4d2c4a5f42f88fdd07cb75feba3467e4d4c043c.patch >> >> Pros/cons: >> >> - Having PEFS in base would be a huge maintenance help for PCBSD/TrueOS >> who are already committed to use PEFS in next product releases, e.g. >> PCBSD provides encrypted home directories. >> >> - There is steady interest in the project from users (emails, etc). >> Many of them note that file system is not well known yet. Moving PEFS >> to base would greatly increase its exposure. >> >> - Committing PEFS to base would also simplify maintenance by keeping it >> in sync with other subsystems, e.g. it will be updated on large scale >> changes like VM locking. >> >> - There are no bugs known at the moment. I've been using it to encrypt >> home directory since day one. pho@ ran stress test suite on it a >> while back, number of bugs was fixed. >> >> - PEFS is known to work on amd64 and i386 only. Big endian system and >> systems with page size larger than 4k are not tested. >> >> - NOTE! There has been no cryptography review. I'd like to suggest to >> add warning about file system and crypto used is experimental and hasn't >> undergone professional review. Similar to one we had in tmpfs. >> >> >> BSD Magazine article: >> http://bsdmag.org/magazine/1848-day-to-day-bsd-administration >> >> Port: >> http://www.freshports.org/sysutils/pefs-kmod/ >> >> Source code repository: >> https://github.com/glk/pefs >> >> FreeBSD DevSummit'2011 - pefs presentation slides: >> https://pefs.googlecode.com/files/pefs-devsummit.pdf >> >> FreeBSD wiki page: >> https://wiki.freebsd.org/PEFS >> >> >> I would really appreciate any comments or suggestions. >> >> >> Thank you, >> Gleb. > > Just a personal note: I hoped that you would commit pefs to base > someday. It works well, and is the type of a core functionality that > would be nice to have as early as the install ISO, before skel is copied > over for the first user. I would be happy if this happened. > Agree. It would also be nice to have standard way to mount pefs file systems because they need to be mounted at later point during boot after other file systems mounted. Small rc.d script should do the trick. I think those issues should be addressed after PEFS is committed > - Nikolai Lifanov >