Native Encryption for ZFS on Linux

[mirror_zfs.git] / cmd / zpool / zpool_main.c

diff --git a/cmd/zpool/zpool_main.c b/cmd/zpool/zpool_main.c
index 60713197db5b55a2dd107d360b8cc4d2a6dfa95e..3ffd13c8ead3b452d0ffa72caf4110730b1d2bb4 100644 (file)
--- a/cmd/zpool/zpool_main.c
+++ b/cmd/zpool/zpool_main.c
@@ -55,7 +55,7 @@
 #include <sys/fm/util.h>
 #include <sys/fm/protocol.h>
 #include <sys/zfs_ioctl.h>
-
+#include <sys/mount.h>
 #include <math.h>
 
 #include <libzfs.h>
@@ -313,12 +313,13 @@ get_usage(zpool_help_t idx)
                return (gettext("\thistory [-il] [<pool>] ...\n"));
        case HELP_IMPORT:
                return (gettext("\timport [-d dir] [-D]\n"
-                   "\timport [-d dir | -c cachefile] [-F [-n]] <pool | id>\n"
+                   "\timport [-d dir | -c cachefile] [-F [-n]] [-l] "
+                   "<pool | id>\n"
                    "\timport [-o mntopts] [-o property=value] ... \n"
-                   "\t    [-d dir | -c cachefile] [-D] [-f] [-m] [-N] "
+                   "\t    [-d dir | -c cachefile] [-D] [-l] [-f] [-m] [-N] "
                    "[-R root] [-F [-n]] -a\n"
                    "\timport [-o mntopts] [-o property=value] ... \n"
-                   "\t    [-d dir | -c cachefile] [-D] [-f] [-m] [-N] "
+                   "\t    [-d dir | -c cachefile] [-D] [-l] [-f] [-m] [-N] "
                    "[-R root] [-F [-n]]\n"
                    "\t    <pool | id> [newpool]\n"));
        case HELP_IOSTAT:
@@ -359,7 +360,7 @@ get_usage(zpool_help_t idx)
        case HELP_SET:
                return (gettext("\tset <property=value> <pool> \n"));
        case HELP_SPLIT:
-               return (gettext("\tsplit [-gLnP] [-R altroot] [-o mntopts]\n"
+               return (gettext("\tsplit [-gLnPl] [-R altroot] [-o mntopts]\n"
                    "\t    [-o property=value] <pool> <newpool> "
                    "[<device> ...]\n"));
        case HELP_REGUID:
@@ -2261,6 +2262,7 @@ static int
 do_import(nvlist_t *config, const char *newname, const char *mntopts,
     nvlist_t *props, int flags)
 {
+       int ret = 0;
        zpool_handle_t *zhp;
        char *name;
        uint64_t state;
@@ -2343,6 +2345,16 @@ do_import(nvlist_t *config, const char *newname, const char *mntopts,
        if ((zhp = zpool_open_canfail(g_zfs, name)) == NULL)
                return (1);
 
+       /*
+        * Loading keys is best effort. We don't want to return immediately
+        * if it fails but we do want to give the error to the caller.
+        */
+       if (flags & ZFS_IMPORT_LOAD_KEYS) {
+               ret = zfs_crypto_attempt_load_keys(g_zfs, name);
+               if (ret != 0)
+                       ret = 1;
+       }
+
        if (zpool_get_state(zhp) != POOL_STATE_UNAVAIL &&
            !(flags & ZFS_IMPORT_ONLY) &&
            zpool_enable_datasets(zhp, mntopts, 0) != 0) {
@@ -2351,14 +2363,14 @@ do_import(nvlist_t *config, const char *newname, const char *mntopts,
        }
 
        zpool_close(zhp);
-       return (0);
+       return (ret);
 }
 
 /*
  * zpool import [-d dir] [-D]
- *       import [-o mntopts] [-o prop=value] ... [-R root] [-D]
+ *       import [-o mntopts] [-o prop=value] ... [-R root] [-D] [-l]
  *              [-d dir | -c cachefile] [-f] -a
- *       import [-o mntopts] [-o prop=value] ... [-R root] [-D]
+ *       import [-o mntopts] [-o prop=value] ... [-R root] [-D] [-l]
  *              [-d dir | -c cachefile] [-f] [-n] [-F] <pool | id> [newpool]
  *
  *      -c     Read pool information from a cachefile instead of searching
@@ -2393,6 +2405,8 @@ do_import(nvlist_t *config, const char *newname, const char *mntopts,
  *
  *       -a    Import all pools found.
  *
+ *       -l    Load encryption keys while importing.
+ *
  *       -o    Set property=value and/or temporary mount options (without '=').
  *
  *      -s     Scan using the default search path, the libblkid cache will
@@ -2434,7 +2448,7 @@ zpool_do_import(int argc, char **argv)
        char *endptr;
 
        /* check options */
-       while ((c = getopt(argc, argv, ":aCc:d:DEfFmnNo:R:stT:VX")) != -1) {
+       while ((c = getopt(argc, argv, ":aCc:d:DEfFlmnNo:R:stT:VX")) != -1) {
                switch (c) {
                case 'a':
                        do_all = B_TRUE;
@@ -2464,6 +2478,9 @@ zpool_do_import(int argc, char **argv)
                case 'F':
                        do_rewind = B_TRUE;
                        break;
+               case 'l':
+                       flags |= ZFS_IMPORT_LOAD_KEYS;
+                       break;
                case 'm':
                        flags |= ZFS_IMPORT_MISSING_LOG;
                        break;
@@ -2538,6 +2555,17 @@ zpool_do_import(int argc, char **argv)
                usage(B_FALSE);
        }
 
+       if ((flags & ZFS_IMPORT_LOAD_KEYS) && (flags & ZFS_IMPORT_ONLY)) {
+               (void) fprintf(stderr, gettext("-l is incompatible with -N\n"));
+               usage(B_FALSE);
+       }
+
+       if ((flags & ZFS_IMPORT_LOAD_KEYS) && !do_all && argc == 0) {
+               (void) fprintf(stderr, gettext("-l is only meaningful during "
+                   "an import\n"));
+               usage(B_FALSE);
+       }
+
        if ((dryrun || xtreme_rewind) && !do_rewind) {
                (void) fprintf(stderr,
                    gettext("-n or -X only meaningful with -F\n"));
@@ -5370,6 +5398,7 @@ zpool_do_detach(int argc, char **argv)
  *     -o      Set property=value, or set mount options.
  *     -P      Display full path for vdev name.
  *     -R      Mount the split-off pool under an alternate root.
+ *     -l      Load encryption keys while importing.
  *
  * Splits the named pool and gives it the new pool name.  Devices to be split
  * off may be listed, provided that no more than one device is specified
@@ -5387,6 +5416,7 @@ zpool_do_split(int argc, char **argv)
        char *mntopts = NULL;
        splitflags_t flags;
        int c, ret = 0;
+       boolean_t loadkeys = B_FALSE;
        zpool_handle_t *zhp;
        nvlist_t *config, *props = NULL;
 
@@ -5395,7 +5425,7 @@ zpool_do_split(int argc, char **argv)
        flags.name_flags = 0;
 
        /* check options */
-       while ((c = getopt(argc, argv, ":gLR:no:P")) != -1) {
+       while ((c = getopt(argc, argv, ":gLR:lno:P")) != -1) {
                switch (c) {
                case 'g':
                        flags.name_flags |= VDEV_NAME_GUID;
@@ -5412,6 +5442,9 @@ zpool_do_split(int argc, char **argv)
                                usage(B_FALSE);
                        }
                        break;
+               case 'l':
+                       loadkeys = B_TRUE;
+                       break;
                case 'n':
                        flags.dryrun = B_TRUE;
                        break;
@@ -5450,6 +5483,12 @@ zpool_do_split(int argc, char **argv)
                usage(B_FALSE);
        }
 
+       if (!flags.import && loadkeys) {
+               (void) fprintf(stderr, gettext("loading keys is only "
+                   "valid when importing the pool\n"));
+               usage(B_FALSE);
+       }
+
        argc -= optind;
        argv += optind;
 
@@ -5502,6 +5541,13 @@ zpool_do_split(int argc, char **argv)
                nvlist_free(props);
                return (1);
        }
+
+       if (loadkeys) {
+               ret = zfs_crypto_attempt_load_keys(g_zfs, newpool);
+               if (ret != 0)
+                       ret = 1;
+       }
+
        if (zpool_get_state(zhp) != POOL_STATE_UNAVAIL &&
            zpool_enable_datasets(zhp, mntopts, 0) != 0) {
                ret = 1;