Skip to content

Unlock ZFS Datasets with Shavee during boot #16

Open
Open
Unlock ZFS Datasets with Shavee during boot#16

Description

@marcaddeo
marcaddeo
opened on Sep 21, 2021

I'm using Shavee to unlock a ZFS dataset as part of my boot process, and thought I'd share how I'm doing it:

/etc/systemd/system/zfs-shavee-unlock@.service

[Unit]
Description=Unlock ZFS Dataset %I with Shavee
DefaultDependencies=no
Before=systemd-user-sessions.service
Before=zfs-mount.service
After=zfs-import.target
After=systemd-vconsole-setup.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/sh -c 'set -eu;keystatus="$$(/sbin/zfs get -H -o value keystatus "%I")";[ "$$keystatus" = "unavailable" ] || exit 0;count=0;while [ $$count -lt 3 ];do  systemd-ask-password --id="zfs:%I"    "Enter passphrase for %I"|    shavee -y -s 1 -z "%I" && exit 0;  count=$$((count + 1));done;exit 1'
ExecStop=/bin/sh -c 'set -eu;keystatus="$$(/sbin/zfs get -H -o value keystatus "%I")";[ "$$keystatus" = "available" ] || exit 0;/sbin/zfs unload-key "%I"'

[Install]
WantedBy=zfs-mount.service

I'm using Slot 1 for HMAC challenges on my Yubikey, so you may need to alter the Shavee command if you're using a different slot

Then just enable the service for your encrypted pool, e.g. to unlock zroot/data you'd do systemctl enable zfs-shavee-unlock@zroot-data

Activity

  2. marcaddeo commented on Sep 21, 2021

    @marcaddeo
    marcaddeo
    on Sep 21, 2021
    Author

    There's no easy way to do that as far as I know. You can pass an "instance" to a systemd service with the @ convention. It will convert hyphens to slashes. So you'd have to figure out a way to encode the Shavee options, a separator, and the dataset name.

  3. marcaddeo commented on Sep 21, 2021

    @marcaddeo
    marcaddeo
    on Sep 21, 2021
    Author

    https://unix.stackexchange.com/questions/323914/dynamic-variables-in-systemd-service-unit-files

  4. ashuio commented on Sep 22, 2021

    @ashuio
    ashuio
    on Sep 22, 2021
    Owner

    I think we can try using configuration files with systemd services.

  6. marcaddeo commented on Sep 27, 2021

    @marcaddeo
    marcaddeo
    on Sep 27, 2021
    Author

    Config files seem like a good idea!

  9. ashuio commented on Feb 16, 2025

    @ashuio
    ashuio
    on Feb 16, 2025
    Owner

    I think the new features of storing the config on dataset itself should be enough to unlock multiple sets during boot with systemd.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions