97aeda2243
The zfskeys service script starts before the zfs service script, so that
dataset decryption keys are available when `zfs mount -a` is run. One of
the potential edge cases of this design is that if a key is stored on
ZFS it won't be loaded until `zfs mount -a` is issued.
In order to address that let's try to load the additional keys and mount
related ZFS datasets after the zfs script finishes its standard mounting
procedure.
PR: 262468
Reported by: Graham Perrin <grahamperrin@gmail.com>
Reviewed by: allanjude
Approved by: allanjude (src)
Fixes: 33ff39796f Add zfskeys rc.d script for auto-loading encryption keys
MFC after: 3 days
Sponsored by: Modirum
Sponsored by: Klara Inc.
Differential Revision: https://reviews.freebsd.org/D34601
80 lines
1.1 KiB
Bash
Executable File
80 lines
1.1 KiB
Bash
Executable File
#!/bin/sh
|
|
#
|
|
# $FreeBSD$
|
|
#
|
|
|
|
# PROVIDE: zfs
|
|
# REQUIRE: zfsbe
|
|
# BEFORE: FILESYSTEMS var
|
|
|
|
. /etc/rc.subr
|
|
|
|
name="zfs"
|
|
desc="Mount and share ZFS datasets"
|
|
rcvar="zfs_enable"
|
|
start_cmd="zfs_start"
|
|
start_postcmd="zfs_poststart"
|
|
stop_cmd="zfs_stop"
|
|
required_modules="zfs"
|
|
|
|
zfs_start_jail()
|
|
{
|
|
if [ `$SYSCTL_N security.jail.mount_allowed` -eq 1 ]; then
|
|
zfs mount -a
|
|
fi
|
|
}
|
|
|
|
zfs_start_main()
|
|
{
|
|
zfs mount -va
|
|
zfs share -a
|
|
if [ ! -r /etc/zfs/exports ]; then
|
|
touch /etc/zfs/exports
|
|
fi
|
|
}
|
|
|
|
zfs_start()
|
|
{
|
|
if [ `$SYSCTL_N security.jail.jailed` -eq 1 ]; then
|
|
zfs_start_jail
|
|
else
|
|
zfs_start_main
|
|
fi
|
|
}
|
|
|
|
zfs_poststart()
|
|
{
|
|
# Some of the keys to decrypt datasets are potentially stored on ZFS
|
|
# datasets that just got mounted. Let's try to load those keys and
|
|
# mount the datasets.
|
|
if checkyesno zfskeys_enable; then
|
|
/etc/rc.d/zfskeys start
|
|
zfs_start
|
|
fi
|
|
}
|
|
|
|
zfs_stop_jail()
|
|
{
|
|
if [ `$SYSCTL_N security.jail.mount_allowed` -eq 1 ]; then
|
|
zfs unmount -a
|
|
fi
|
|
}
|
|
|
|
zfs_stop_main()
|
|
{
|
|
zfs unshare -a
|
|
zfs unmount -a
|
|
}
|
|
|
|
zfs_stop()
|
|
{
|
|
if [ `$SYSCTL_N security.jail.jailed` -eq 1 ]; then
|
|
zfs_stop_jail
|
|
else
|
|
zfs_stop_main
|
|
fi
|
|
}
|
|
|
|
load_rc_config $name
|
|
run_rc_command "$1"
|