mirror of
https://git.sr.ht/~nabijaczleweli/tzpfms
synced 2025-04-21 09:47:35 +03:00
Initial manpage commit
This commit is contained in:
наб
commit
d0979bb54c
8
index.txt
Normal file
8
index.txt
Normal file
@ -0,0 +1,8 @@
|
||||
zfs-tpm2-change-key(8) zfs-tpm2-change-key.8.ronn
|
||||
zfs-tpm2-load-key(8) zfs-tpm2-load-key.8.ronn
|
||||
zfs-tpm2-clear-key(8) zfs-tpm2-clear-key.8.ronn
|
||||
|
||||
zfs(8) https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html
|
||||
tpm2_unseal(1) https://manpages.debian.org/bullseye/tpm2-tools/tpm2_unseal.1.en.html
|
||||
|
||||
ESYS_CONTEXT(3) https://www.mankier.com/3/ESYS_CONTEXT
|
||||
62
zfs-tpm2-change-key.8
Normal file
62
zfs-tpm2-change-key.8
Normal file
@ -0,0 +1,62 @@
|
||||
.\" generated with Ronn-NG/v0.9.1
|
||||
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
|
||||
.TH "ZFS\-TPM2\-CHANGE\-KEY" "8" "October 2020" "tzpfms developers"
|
||||
.SH "NAME"
|
||||
\fBzfs\-tpm2\-change\-key\fR \- change ZFS dataset key to one stored on the TPM
|
||||
.SH "SYNOPSIS"
|
||||
\fBzfs\-tpm2\-change\-key\fR [\-b file] \fIdataset\fR
|
||||
.SH "DESCRIPTION"
|
||||
To normalise \fBdataset\fR, zfs\-tpm2\-change\-key(8) will open its encryption root in its stead\. zfs\-tpm2\-change\-key(8) will \fInever\fR create or destroy encryption roots; use \fBzfs(8) change\-key\fR for that\.
|
||||
.P
|
||||
First, a connection is made to the TPM, which \fImust\fR be TPM\-2\.0\-compatible\.
|
||||
.P
|
||||
If \fBdataset\fR was previously encrypted with tzpfms and the \fITPM2\fR back\-end was used, the previous key will be freed from the TPM\. Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream\.
|
||||
.P
|
||||
Next, a new wrapping key is be generated on the TPM, optionally backed up (see \fIOPTIONS\fR), and sealed to a persistent object on the TPM under the owner hierarchy\.
|
||||
.P
|
||||
The following properties are set on \fBdataset\fR:
|
||||
.IP "\[ci]" 4
|
||||
\fBxyz\.nabijaczleweli:tzpfms\.backend\fR=\fBTPM2\fR
|
||||
.IP "\[ci]" 4
|
||||
\fBxyz\.nabijaczleweli:tzpfms\.key\fR=\fI(ID of persistent object)\fR
|
||||
.IP "" 0
|
||||
.P
|
||||
\fBtzpfms\.backend\fR identifies this dataset for work with \fITPM2\fR\-back\-ended tzpfms tools (namely zfs\-tpm2\-change\-key(8), zfs\-tpm2\-load\-key(8), and zfs\-tpm2\-clear\-key(8))\.
|
||||
.P
|
||||
\fBtzpfms\.key\fR is an integer representing the sealed object; if needed, it can be passed to \fBtpm2_unseal(1) \-c ${tzpfms\.key}\fR or equivalent for back\-up (see \fIOPTIONS\fR)\. If you have a sealed key you can access with that or equivalent tool and set both of these properties, it will funxion seamlessly\.
|
||||
.P
|
||||
Finally, the equivalent of \fBzfs(8) change\-key \-o keylocation=prompt \-o keyformat=raw dataset\fR is performed with the new key\. If an error occurred, best effort is made to clean up the persistent object and properties, or to issue a note for manual intervention into the standard error stream\.
|
||||
.P
|
||||
A final verification should be made by running \fBzfs\-tpm2\-load\-key(8) \-n dataset\fR\. If that command succeeds, all is well, but otherwise the dataset can be manually rolled back to a password with \fBzfs\-tpm2\-clear\-key(8) dataset\fR (or, if that fails to work, \fBzfs(8) change\-key \-o keyformat=passphrase dataset\fR), and you are hereby asked to report a bug, please\.
|
||||
.P
|
||||
\fBzfs\-tpm2\-clear\-key(8) dataset\fR can be used to free the TPM persistent object and go back to using a password\.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-b\fR \fIfile\fR
|
||||
Save a back\-up of the key to \fIfile\fR, which must not exist beforehand\. This back\-up \fBmust\fR be stored securely, off\-site\. In case of a catastrophic event, the key can be loaded by running \fBzfs(8) load\-key dataset < backup\-file\fR\.
|
||||
.SH "TPM2 back\-end configuration"
|
||||
.SS "Environment variables"
|
||||
.TP
|
||||
\fBTSS2_LOG\fR=
|
||||
Any of: \fINONE\fR, \fIERROR\fR, \fIWARNING\fR, \fIINFO\fR, \fIDEBUG\fR, \fITRACE\fR\. Default: \fIWARNING\fR\.
|
||||
.SS "TPM selection"
|
||||
The library \fBlibtss2\-tcti\-default\.so\fR can be linked to any of the \fBlibtss2\-tcti\-*\.so\fR libraries to select the default, otherwise \fB/dev/tpmrm0\fR, then \fB/dev/tpm0\fR, then \fBlocalhost:2321\fR will be tried, in order (see ESYS_CONTEXT(3))\.
|
||||
.SS "See also"
|
||||
The tpm2\-tss git repository at \fIhttps://github\.com/tpm2\-software/tpm2\-tss\fR and the documentation at \fIhttps://tpm2\-tss\.readthedocs\.io\fR\.
|
||||
.P
|
||||
The TPM 2\.0 specifications, mainly at <\fIhttps://trustedcomputinggroup\.org/wp\-content/uploads/TPM\-Rev\-2\.0\-Part\-1\-Architecture\-01\.38\.pdf\fR> and related pages\.
|
||||
.SH "AUTHOR"
|
||||
Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR>
|
||||
.SH "SPECIAL THANKS"
|
||||
To all who support further development, in particular:
|
||||
.IP "\[ci]" 4
|
||||
ThePhD
|
||||
.IP "\[ci]" 4
|
||||
Embark Studios
|
||||
.IP "" 0
|
||||
.SH "REPORTING BUGS"
|
||||
<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR>
|
||||
.P
|
||||
<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR>
|
||||
.SH "SEE ALSO"
|
||||
<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR>
|
||||
187
zfs-tpm2-change-key.8.html
Normal file
187
zfs-tpm2-change-key.8.html
Normal file
@ -0,0 +1,187 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv='content-type' content='text/html;charset=utf8'>
|
||||
<meta name='generator' content='Ronn-NG/v0.9.1 (http://github.com/apjanke/ronn-ng/tree/0.9.1)'>
|
||||
<title>zfs-tpm2-change-key(8) - change ZFS dataset key to one stored on the TPM</title>
|
||||
<style type='text/css' media='all'>
|
||||
/* style: man */
|
||||
body#manpage {margin:0}
|
||||
.mp {max-width:100ex;padding:0 9ex 1ex 4ex}
|
||||
.mp p,.mp pre,.mp ul,.mp ol,.mp dl {margin:0 0 20px 0}
|
||||
.mp h2 {margin:10px 0 0 0}
|
||||
.mp > p,.mp > pre,.mp > ul,.mp > ol,.mp > dl {margin-left:8ex}
|
||||
.mp h3 {margin:0 0 0 4ex}
|
||||
.mp dt {margin:0;clear:left}
|
||||
.mp dt.flush {float:left;width:8ex}
|
||||
.mp dd {margin:0 0 0 9ex}
|
||||
.mp h1,.mp h2,.mp h3,.mp h4 {clear:left}
|
||||
.mp pre {margin-bottom:20px}
|
||||
.mp pre+h2,.mp pre+h3 {margin-top:22px}
|
||||
.mp h2+pre,.mp h3+pre {margin-top:5px}
|
||||
.mp img {display:block;margin:auto}
|
||||
.mp h1.man-title {display:none}
|
||||
.mp,.mp code,.mp pre,.mp tt,.mp kbd,.mp samp,.mp h3,.mp h4 {font-family:monospace;font-size:14px;line-height:1.42857142857143}
|
||||
.mp h2 {font-size:16px;line-height:1.25}
|
||||
.mp h1 {font-size:20px;line-height:2}
|
||||
.mp {text-align:justify;background:#fff}
|
||||
.mp,.mp code,.mp pre,.mp pre code,.mp tt,.mp kbd,.mp samp {color:#131211}
|
||||
.mp h1,.mp h2,.mp h3,.mp h4 {color:#030201}
|
||||
.mp u {text-decoration:underline}
|
||||
.mp code,.mp strong,.mp b {font-weight:bold;color:#131211}
|
||||
.mp em,.mp var {font-style:italic;color:#232221;text-decoration:none}
|
||||
.mp a,.mp a:link,.mp a:hover,.mp a code,.mp a pre,.mp a tt,.mp a kbd,.mp a samp {color:#0000ff}
|
||||
.mp b.man-ref {font-weight:normal;color:#434241}
|
||||
.mp pre {padding:0 4ex}
|
||||
.mp pre code {font-weight:normal;color:#434241}
|
||||
.mp h2+pre,h3+pre {padding-left:0}
|
||||
ol.man-decor,ol.man-decor li {margin:3px 0 10px 0;padding:0;float:left;width:33%;list-style-type:none;text-transform:uppercase;color:#999;letter-spacing:1px}
|
||||
ol.man-decor {width:100%}
|
||||
ol.man-decor li.tl {text-align:left}
|
||||
ol.man-decor li.tc {text-align:center;letter-spacing:4px}
|
||||
ol.man-decor li.tr {text-align:right;float:right}
|
||||
</style>
|
||||
</head>
|
||||
<!--
|
||||
The following styles are deprecated and will be removed at some point:
|
||||
div#man, div#man ol.man, div#man ol.head, div#man ol.man.
|
||||
|
||||
The .man-page, .man-decor, .man-head, .man-foot, .man-title, and
|
||||
.man-navigation should be used instead.
|
||||
-->
|
||||
<body id='manpage'>
|
||||
<div class='mp' id='man'>
|
||||
|
||||
<div class='man-navigation' style='display:none'>
|
||||
<a href="#NAME">NAME</a>
|
||||
<a href="#SYNOPSIS">SYNOPSIS</a>
|
||||
<a href="#DESCRIPTION">DESCRIPTION</a>
|
||||
<a href="#OPTIONS">OPTIONS</a>
|
||||
<a href="#TPM2-BACK-END-CONFIGURATION">TPM2 back-end configuration</a>
|
||||
<a href="#AUTHOR">AUTHOR</a>
|
||||
<a href="#SPECIAL-THANKS">SPECIAL THANKS</a>
|
||||
<a href="#REPORTING-BUGS">REPORTING BUGS</a>
|
||||
<a href="#SEE-ALSO">SEE ALSO</a>
|
||||
</div>
|
||||
|
||||
<ol class='man-decor man-head man head'>
|
||||
<li class='tl'>zfs-tpm2-change-key(8)</li>
|
||||
<li class='tc'></li>
|
||||
<li class='tr'>zfs-tpm2-change-key(8)</li>
|
||||
</ol>
|
||||
|
||||
|
||||
|
||||
<h2 id="NAME">NAME</h2>
|
||||
<p class="man-name">
|
||||
<code>zfs-tpm2-change-key</code> - <span class="man-whatis">change ZFS dataset key to one stored on the TPM</span>
|
||||
</p>
|
||||
<h2 id="SYNOPSIS">SYNOPSIS</h2>
|
||||
|
||||
<p><code>zfs-tpm2-change-key</code> [-b file] <var>dataset</var></p>
|
||||
|
||||
<h2 id="DESCRIPTION">DESCRIPTION</h2>
|
||||
|
||||
<p>To normalise <code>dataset</code>, <a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a> will open its encryption root in its stead.
|
||||
<a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a> will <em>never</em> create or destroy encryption roots; use <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key</strong> for that.</p>
|
||||
|
||||
<p>First, a connection is made to the TPM, which <em>must</em> be TPM-2.0-compatible.</p>
|
||||
|
||||
<p>If <code>dataset</code> was previously encrypted with tzpfms and the <em>TPM2</em> back-end was used, the previous key will be freed from the TPM.
|
||||
Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream.</p>
|
||||
|
||||
<p>Next, a new wrapping key is be generated on the TPM, optionally backed up (see <a href="#OPTIONS" title="OPTIONS" data-bare-link="true">OPTIONS</a>),
|
||||
and sealed to a persistent object on the TPM under the owner hierarchy.</p>
|
||||
|
||||
<p>The following properties are set on <code>dataset</code>:</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<code>xyz.nabijaczleweli:tzpfms.backend</code>=<code>TPM2</code>
|
||||
</li>
|
||||
<li>
|
||||
<code>xyz.nabijaczleweli:tzpfms.key</code>=<em>(ID of persistent object)</em>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<p><code>tzpfms.backend</code> identifies this dataset for work with <em>TPM2</em>-back-ended tzpfms tools
|
||||
(namely <a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a>, <a class="man-ref" href="zfs-tpm2-load-key.8.html">zfs-tpm2-load-key<span class="s">(8)</span></a>, and <a class="man-ref" href="zfs-tpm2-clear-key.8.html">zfs-tpm2-clear-key<span class="s">(8)</span></a>).</p>
|
||||
|
||||
<p><code>tzpfms.key</code> is an integer representing the sealed object;
|
||||
if needed, it can be passed to <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/tpm2-tools/tpm2_unseal.1.en.html">tpm2_unseal<span class="s">(1)</span></a> -c ${tzpfms.key}</strong> or equivalent for back-up (see <a href="#OPTIONS" title="OPTIONS" data-bare-link="true">OPTIONS</a>).
|
||||
If you have a sealed key you can access with that or equivalent tool and set both of these properties, it will funxion seamlessly.</p>
|
||||
|
||||
<p>Finally, the equivalent of <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key -o keylocation=prompt -o keyformat=raw dataset</strong> is performed with the new key.
|
||||
If an error occurred, best effort is made to clean up the persistent object and properties,
|
||||
or to issue a note for manual intervention into the standard error stream.</p>
|
||||
|
||||
<p>A final verification should be made by running <strong><a class="man-ref" href="zfs-tpm2-load-key.8.html">zfs-tpm2-load-key<span class="s">(8)</span></a> -n dataset</strong>.
|
||||
If that command succeeds, all is well,
|
||||
but otherwise the dataset can be manually rolled back to a password with <strong><a class="man-ref" href="zfs-tpm2-clear-key.8.html">zfs-tpm2-clear-key<span class="s">(8)</span></a> dataset</strong> (or, if that fails to work, <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key -o keyformat=passphrase dataset</strong>), and you are hereby asked to report a bug, please.</p>
|
||||
|
||||
<p><strong><a class="man-ref" href="zfs-tpm2-clear-key.8.html">zfs-tpm2-clear-key<span class="s">(8)</span></a> dataset</strong> can be used to free the TPM persistent object and go back to using a password.</p>
|
||||
|
||||
<h2 id="OPTIONS">OPTIONS</h2>
|
||||
|
||||
<dl>
|
||||
<dt>
|
||||
<code>-b</code> <em>file</em>
|
||||
</dt>
|
||||
<dd>Save a back-up of the key to <em>file</em>, which must not exist beforehand.
|
||||
This back-up <strong>must</strong> be stored securely, off-site.
|
||||
In case of a catastrophic event, the key can be loaded by running <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> load-key dataset < backup-file</strong>.</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="TPM2-back-end-configuration">TPM2 back-end configuration</h2>
|
||||
|
||||
<h3 id="Environment-variables">Environment variables</h3>
|
||||
|
||||
<dl>
|
||||
<dt>
|
||||
<code>TSS2_LOG</code>=</dt>
|
||||
<dd>Any of: <em>NONE</em>, <em>ERROR</em>, <em>WARNING</em>, <em>INFO</em>, <em>DEBUG</em>, <em>TRACE</em>. Default: <em>WARNING</em>.</dd>
|
||||
</dl>
|
||||
|
||||
<h3 id="TPM-selection">TPM selection</h3>
|
||||
|
||||
<p>The library <code>libtss2-tcti-default.so</code> can be linked to any of the <code>libtss2-tcti-*.so</code> libraries to select the default,
|
||||
otherwise <code>/dev/tpmrm0</code>, then <code>/dev/tpm0</code>, then <code>localhost:2321</code> will be tried, in order (see <a class="man-ref" href="https://www.mankier.com/3/ESYS_CONTEXT">ESYS_CONTEXT<span class="s">(3)</span></a>).</p>
|
||||
|
||||
<h3 id="See-also">See also</h3>
|
||||
|
||||
<p>The tpm2-tss git repository at <a href="https://github.com/tpm2-software/tpm2-tss" data-bare-link="true">https://github.com/tpm2-software/tpm2-tss</a> and the documentation at <a href="https://tpm2-tss.readthedocs.io" data-bare-link="true">https://tpm2-tss.readthedocs.io</a>.</p>
|
||||
|
||||
<p>The TPM 2.0 specifications, mainly at <<a href="https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf" data-bare-link="true">https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf</a>> and related pages.</p>
|
||||
|
||||
<h2 id="AUTHOR">AUTHOR</h2>
|
||||
|
||||
<p>Written by наб <<a href="mailto:nabijaczleweli@nabijaczleweli.xyz" data-bare-link="true">nabijaczleweli@nabijaczleweli.xyz</a>></p>
|
||||
|
||||
<h2 id="SPECIAL-THANKS">SPECIAL THANKS</h2>
|
||||
|
||||
<p>To all who support further development, in particular:</p>
|
||||
|
||||
<ul>
|
||||
<li>ThePhD</li>
|
||||
<li>Embark Studios</li>
|
||||
</ul>
|
||||
|
||||
<h2 id="REPORTING-BUGS">REPORTING BUGS</h2>
|
||||
|
||||
<p><<a href="https://todo.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://todo.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<p><<a href="mailto:~nabijaczleweli/tzpfms@lists.sr.ht" data-bare-link="true">~nabijaczleweli/tzpfms@lists.sr.ht</a>>, archived at <<a href="https://lists.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://lists.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<h2 id="SEE-ALSO">SEE ALSO</h2>
|
||||
|
||||
<p><<a href="https://git.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://git.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<ol class='man-decor man-foot man foot'>
|
||||
<li class='tl'>tzpfms developers</li>
|
||||
<li class='tc'>October 2020</li>
|
||||
<li class='tr'>zfs-tpm2-change-key(8)</li>
|
||||
</ol>
|
||||
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
106
zfs-tpm2-change-key.8.html_fragment
Normal file
106
zfs-tpm2-change-key.8.html_fragment
Normal file
@ -0,0 +1,106 @@
|
||||
<div class='mp'>
|
||||
|
||||
<h2 id="NAME">NAME</h2>
|
||||
<p class="man-name">
|
||||
<code>zfs-tpm2-change-key</code> - <span class="man-whatis">change ZFS dataset key to one stored on the TPM</span>
|
||||
</p>
|
||||
<h2 id="SYNOPSIS">SYNOPSIS</h2>
|
||||
|
||||
<p><code>zfs-tpm2-change-key</code> [-b file] <var>dataset</var></p>
|
||||
|
||||
<h2 id="DESCRIPTION">DESCRIPTION</h2>
|
||||
|
||||
<p>To normalise <code>dataset</code>, <a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a> will open its encryption root in its stead.
|
||||
<a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a> will <em>never</em> create or destroy encryption roots; use <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key</strong> for that.</p>
|
||||
|
||||
<p>First, a connection is made to the TPM, which <em>must</em> be TPM-2.0-compatible.</p>
|
||||
|
||||
<p>If <code>dataset</code> was previously encrypted with tzpfms and the <em>TPM2</em> back-end was used, the previous key will be freed from the TPM.
|
||||
Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream.</p>
|
||||
|
||||
<p>Next, a new wrapping key is be generated on the TPM, optionally backed up (see <a href="#OPTIONS" title="OPTIONS" data-bare-link="true">OPTIONS</a>),
|
||||
and sealed to a persistent object on the TPM under the owner hierarchy.</p>
|
||||
|
||||
<p>The following properties are set on <code>dataset</code>:</p>
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
<code>xyz.nabijaczleweli:tzpfms.backend</code>=<code>TPM2</code>
|
||||
</li>
|
||||
<li>
|
||||
<code>xyz.nabijaczleweli:tzpfms.key</code>=<em>(ID of persistent object)</em>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
<p><code>tzpfms.backend</code> identifies this dataset for work with <em>TPM2</em>-back-ended tzpfms tools
|
||||
(namely <a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a>, <a class="man-ref" href="zfs-tpm2-load-key.8.html">zfs-tpm2-load-key<span class="s">(8)</span></a>, and <a class="man-ref" href="zfs-tpm2-clear-key.8.html">zfs-tpm2-clear-key<span class="s">(8)</span></a>).</p>
|
||||
|
||||
<p><code>tzpfms.key</code> is an integer representing the sealed object;
|
||||
if needed, it can be passed to <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/tpm2-tools/tpm2_unseal.1.en.html">tpm2_unseal<span class="s">(1)</span></a> -c ${tzpfms.key}</strong> or equivalent for back-up (see <a href="#OPTIONS" title="OPTIONS" data-bare-link="true">OPTIONS</a>).
|
||||
If you have a sealed key you can access with that or equivalent tool and set both of these properties, it will funxion seamlessly.</p>
|
||||
|
||||
<p>Finally, the equivalent of <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key -o keylocation=prompt -o keyformat=raw dataset</strong> is performed with the new key.
|
||||
If an error occurred, best effort is made to clean up the persistent object and properties,
|
||||
or to issue a note for manual intervention into the standard error stream.</p>
|
||||
|
||||
<p>A final verification should be made by running <strong><a class="man-ref" href="zfs-tpm2-load-key.8.html">zfs-tpm2-load-key<span class="s">(8)</span></a> -n dataset</strong>.
|
||||
If that command succeeds, all is well,
|
||||
but otherwise the dataset can be manually rolled back to a password with <strong><a class="man-ref" href="zfs-tpm2-clear-key.8.html">zfs-tpm2-clear-key<span class="s">(8)</span></a> dataset</strong> (or, if that fails to work, <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key -o keyformat=passphrase dataset</strong>), and you are hereby asked to report a bug, please.</p>
|
||||
|
||||
<p><strong><a class="man-ref" href="zfs-tpm2-clear-key.8.html">zfs-tpm2-clear-key<span class="s">(8)</span></a> dataset</strong> can be used to free the TPM persistent object and go back to using a password.</p>
|
||||
|
||||
<h2 id="OPTIONS">OPTIONS</h2>
|
||||
|
||||
<dl>
|
||||
<dt>
|
||||
<code>-b</code> <em>file</em>
|
||||
</dt>
|
||||
<dd>Save a back-up of the key to <em>file</em>, which must not exist beforehand.
|
||||
This back-up <strong>must</strong> be stored securely, off-site.
|
||||
In case of a catastrophic event, the key can be loaded by running <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> load-key dataset < backup-file</strong>.</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="TPM2-back-end-configuration">TPM2 back-end configuration</h2>
|
||||
|
||||
<h3 id="Environment-variables">Environment variables</h3>
|
||||
|
||||
<dl>
|
||||
<dt>
|
||||
<code>TSS2_LOG</code>=</dt>
|
||||
<dd>Any of: <em>NONE</em>, <em>ERROR</em>, <em>WARNING</em>, <em>INFO</em>, <em>DEBUG</em>, <em>TRACE</em>. Default: <em>WARNING</em>.</dd>
|
||||
</dl>
|
||||
|
||||
<h3 id="TPM-selection">TPM selection</h3>
|
||||
|
||||
<p>The library <code>libtss2-tcti-default.so</code> can be linked to any of the <code>libtss2-tcti-*.so</code> libraries to select the default,
|
||||
otherwise <code>/dev/tpmrm0</code>, then <code>/dev/tpm0</code>, then <code>localhost:2321</code> will be tried, in order (see <a class="man-ref" href="https://www.mankier.com/3/ESYS_CONTEXT">ESYS_CONTEXT<span class="s">(3)</span></a>).</p>
|
||||
|
||||
<h3 id="See-also">See also</h3>
|
||||
|
||||
<p>The tpm2-tss git repository at <a href="https://github.com/tpm2-software/tpm2-tss" data-bare-link="true">https://github.com/tpm2-software/tpm2-tss</a> and the documentation at <a href="https://tpm2-tss.readthedocs.io" data-bare-link="true">https://tpm2-tss.readthedocs.io</a>.</p>
|
||||
|
||||
<p>The TPM 2.0 specifications, mainly at <<a href="https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf" data-bare-link="true">https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf</a>> and related pages.</p>
|
||||
|
||||
<h2 id="AUTHOR">AUTHOR</h2>
|
||||
|
||||
<p>Written by наб <<a href="mailto:nabijaczleweli@nabijaczleweli.xyz" data-bare-link="true">nabijaczleweli@nabijaczleweli.xyz</a>></p>
|
||||
|
||||
<h2 id="SPECIAL-THANKS">SPECIAL THANKS</h2>
|
||||
|
||||
<p>To all who support further development, in particular:</p>
|
||||
|
||||
<ul>
|
||||
<li>ThePhD</li>
|
||||
<li>Embark Studios</li>
|
||||
</ul>
|
||||
|
||||
<h2 id="REPORTING-BUGS">REPORTING BUGS</h2>
|
||||
|
||||
<p><<a href="https://todo.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://todo.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<p><<a href="mailto:~nabijaczleweli/tzpfms@lists.sr.ht" data-bare-link="true">~nabijaczleweli/tzpfms@lists.sr.ht</a>>, archived at <<a href="https://lists.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://lists.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<h2 id="SEE-ALSO">SEE ALSO</h2>
|
||||
|
||||
<p><<a href="https://git.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://git.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
</div>
|
||||
87
zfs-tpm2-change-key.md
Normal file
87
zfs-tpm2-change-key.md
Normal file
@ -0,0 +1,87 @@
|
||||
zfs-tpm2-change-key(8) -- change ZFS dataset key to one stored on the TPM
|
||||
=========================================================================
|
||||
|
||||
## SYNOPSIS
|
||||
|
||||
`zfs-tpm2-change-key` [-b file] <dataset>
|
||||
|
||||
## DESCRIPTION
|
||||
|
||||
To normalise `dataset`, zfs-tpm2-change-key(8) will open its encryption root in its stead.
|
||||
zfs-tpm2-change-key(8) will *never* create or destroy encryption roots; use **zfs(8) change-key** for that.
|
||||
|
||||
First, a connection is made to the TPM, which *must* be TPM-2.0-compatible.
|
||||
|
||||
If `dataset` was previously encrypted with tzpfms and the *TPM2* back-end was used, the previous key will be freed from the TPM.
|
||||
Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream.
|
||||
|
||||
Next, a new wrapping key is be generated on the TPM, optionally backed up (see [OPTIONS][]),
|
||||
and sealed to a persistent object on the TPM under the owner hierarchy.
|
||||
|
||||
The following properties are set on `dataset`:
|
||||
|
||||
* `xyz.nabijaczleweli:tzpfms.backend`=`TPM2`
|
||||
* `xyz.nabijaczleweli:tzpfms.key`=*(ID of persistent object)*
|
||||
|
||||
`tzpfms.backend` identifies this dataset for work with *TPM2*-back-ended tzpfms tools
|
||||
(namely zfs-tpm2-change-key(8), zfs-tpm2-load-key(8), and zfs-tpm2-clear-key(8)).
|
||||
|
||||
`tzpfms.key` is an integer representing the sealed object;
|
||||
if needed, it can be passed to **tpm2_unseal(1) -c ${tzpfms.key}** or equivalent for back-up (see [OPTIONS][]).
|
||||
If you have a sealed key you can access with that or equivalent tool and set both of these properties, it will funxion seamlessly.
|
||||
|
||||
Finally, the equivalent of **zfs(8) change-key -o keylocation=prompt -o keyformat=raw dataset** is performed with the new key.
|
||||
If an error occurred, best effort is made to clean up the persistent object and properties,
|
||||
or to issue a note for manual intervention into the standard error stream.
|
||||
|
||||
A final verification should be made by running **zfs-tpm2-load-key(8) -n dataset**.
|
||||
If that command succeeds, all is well,
|
||||
but otherwise the dataset can be manually rolled back to a password with **zfs-tpm2-clear-key(8) dataset** (or, if that fails to work, **zfs(8) change-key -o keyformat=passphrase dataset**), and you are hereby asked to report a bug, please.
|
||||
|
||||
**zfs-tpm2-clear-key(8) dataset** can be used to free the TPM persistent object and go back to using a password.
|
||||
|
||||
## OPTIONS
|
||||
|
||||
* `-b` *file*:
|
||||
Save a back-up of the key to *file*, which must not exist beforehand.
|
||||
This back-up **must** be stored securely, off-site.
|
||||
In case of a catastrophic event, the key can be loaded by running **zfs(8) load-key dataset < backup-file**.
|
||||
|
||||
## TPM2 back-end configuration
|
||||
|
||||
### Environment variables
|
||||
|
||||
* `TSS2_LOG`=:
|
||||
Any of: *NONE*, *ERROR*, *WARNING*, *INFO*, *DEBUG*, *TRACE*. Default: *WARNING*.
|
||||
|
||||
### TPM selection
|
||||
|
||||
The library `libtss2-tcti-default.so` can be linked to any of the `libtss2-tcti-*.so` libraries to select the default,
|
||||
otherwise `/dev/tpmrm0`, then `/dev/tpm0`, then `localhost:2321` will be tried, in order (see ESYS_CONTEXT(3)).
|
||||
|
||||
### See also
|
||||
|
||||
The tpm2-tss git repository at <https://github.com/tpm2-software/tpm2-tss> and the documentation at <https://tpm2-tss.readthedocs.io>.
|
||||
|
||||
The TPM 2.0 specifications, mainly at <<https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf>> and related pages.
|
||||
|
||||
## AUTHOR
|
||||
|
||||
Written by наб <<nabijaczleweli@nabijaczleweli.xyz>>
|
||||
|
||||
## SPECIAL THANKS
|
||||
|
||||
To all who support further development, in particular:
|
||||
|
||||
* ThePhD
|
||||
* Embark Studios
|
||||
|
||||
## REPORTING BUGS
|
||||
|
||||
<<https://todo.sr.ht/~nabijaczleweli/tzpfms>>
|
||||
|
||||
<<mailto:~nabijaczleweli/tzpfms@lists.sr.ht>>, archived at <<https://lists.sr.ht/~nabijaczleweli/tzpfms>>
|
||||
|
||||
## SEE ALSO
|
||||
|
||||
<<https://git.sr.ht/~nabijaczleweli/tzpfms>>
|
||||
44
zfs-tpm2-clear-key.8
Normal file
44
zfs-tpm2-clear-key.8
Normal file
@ -0,0 +1,44 @@
|
||||
.\" generated with Ronn-NG/v0.9.1
|
||||
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
|
||||
.TH "ZFS\-TPM2\-CLEAR\-KEY" "8" "October 2020" "tzpfms developers"
|
||||
.SH "NAME"
|
||||
\fBzfs\-tpm2\-clear\-key\fR \- rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata
|
||||
.SH "SYNOPSIS"
|
||||
\fBzfs\-tpm2\-clear\-key\fR \fIdataset\fR
|
||||
.SH "DESCRIPTION"
|
||||
zfs\-tpm2\-clear\-key(8), after verifying that \fBdataset\fR was encrypted with tzpfms backend \fITPM2\fR will:
|
||||
.IP "1." 4
|
||||
perform the equivalent of \fBzfs(8) change\-key \-o keylocation=prompt \-o keyformat=passphrase dataset\fR,
|
||||
.IP "2." 4
|
||||
free the sealed key previously used to encrypt \fBdataset\fR,
|
||||
.IP "3." 4
|
||||
remove the \fBxyz\.nabijaczleweli:tzpfms\.{backend,key}\fR properties from \fBdataset\fR\.
|
||||
.IP "" 0
|
||||
.P
|
||||
See zfs\-tpm2\-change\-key(8) for a detailed description\.
|
||||
.SH "TPM2 back\-end configuration"
|
||||
.SS "Environment variables"
|
||||
.TP
|
||||
\fBTSS2_LOG\fR=
|
||||
Any of: \fINONE\fR, \fIERROR\fR, \fIWARNING\fR, \fIINFO\fR, \fIDEBUG\fR, \fITRACE\fR\. Default: \fIWARNING\fR\.
|
||||
.SS "TPM selection"
|
||||
The library \fBlibtss2\-tcti\-default\.so\fR can be linked to any of the \fBlibtss2\-tcti\-*\.so\fR libraries to select the default, otherwise \fB/dev/tpmrm0\fR, then \fB/dev/tpm0\fR, then \fBlocalhost:2321\fR will be tried, in order (see ESYS_CONTEXT(3))\.
|
||||
.SS "See also"
|
||||
The tpm2\-tss git repository at \fIhttps://github\.com/tpm2\-software/tpm2\-tss\fR and the documentation at \fIhttps://tpm2\-tss\.readthedocs\.io\fR\.
|
||||
.P
|
||||
The TPM 2\.0 specifications, mainly at <\fIhttps://trustedcomputinggroup\.org/wp\-content/uploads/TPM\-Rev\-2\.0\-Part\-1\-Architecture\-01\.38\.pdf\fR> and related pages\.
|
||||
.SH "AUTHOR"
|
||||
Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR>
|
||||
.SH "SPECIAL THANKS"
|
||||
To all who support further development, in particular:
|
||||
.IP "\[ci]" 4
|
||||
ThePhD
|
||||
.IP "\[ci]" 4
|
||||
Embark Studios
|
||||
.IP "" 0
|
||||
.SH "REPORTING BUGS"
|
||||
<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR>
|
||||
.P
|
||||
<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR>
|
||||
.SH "SEE ALSO"
|
||||
<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR>
|
||||
146
zfs-tpm2-clear-key.8.html
Normal file
146
zfs-tpm2-clear-key.8.html
Normal file
@ -0,0 +1,146 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv='content-type' content='text/html;charset=utf8'>
|
||||
<meta name='generator' content='Ronn-NG/v0.9.1 (http://github.com/apjanke/ronn-ng/tree/0.9.1)'>
|
||||
<title>zfs-tpm2-clear-key(8) - rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata</title>
|
||||
<style type='text/css' media='all'>
|
||||
/* style: man */
|
||||
body#manpage {margin:0}
|
||||
.mp {max-width:100ex;padding:0 9ex 1ex 4ex}
|
||||
.mp p,.mp pre,.mp ul,.mp ol,.mp dl {margin:0 0 20px 0}
|
||||
.mp h2 {margin:10px 0 0 0}
|
||||
.mp > p,.mp > pre,.mp > ul,.mp > ol,.mp > dl {margin-left:8ex}
|
||||
.mp h3 {margin:0 0 0 4ex}
|
||||
.mp dt {margin:0;clear:left}
|
||||
.mp dt.flush {float:left;width:8ex}
|
||||
.mp dd {margin:0 0 0 9ex}
|
||||
.mp h1,.mp h2,.mp h3,.mp h4 {clear:left}
|
||||
.mp pre {margin-bottom:20px}
|
||||
.mp pre+h2,.mp pre+h3 {margin-top:22px}
|
||||
.mp h2+pre,.mp h3+pre {margin-top:5px}
|
||||
.mp img {display:block;margin:auto}
|
||||
.mp h1.man-title {display:none}
|
||||
.mp,.mp code,.mp pre,.mp tt,.mp kbd,.mp samp,.mp h3,.mp h4 {font-family:monospace;font-size:14px;line-height:1.42857142857143}
|
||||
.mp h2 {font-size:16px;line-height:1.25}
|
||||
.mp h1 {font-size:20px;line-height:2}
|
||||
.mp {text-align:justify;background:#fff}
|
||||
.mp,.mp code,.mp pre,.mp pre code,.mp tt,.mp kbd,.mp samp {color:#131211}
|
||||
.mp h1,.mp h2,.mp h3,.mp h4 {color:#030201}
|
||||
.mp u {text-decoration:underline}
|
||||
.mp code,.mp strong,.mp b {font-weight:bold;color:#131211}
|
||||
.mp em,.mp var {font-style:italic;color:#232221;text-decoration:none}
|
||||
.mp a,.mp a:link,.mp a:hover,.mp a code,.mp a pre,.mp a tt,.mp a kbd,.mp a samp {color:#0000ff}
|
||||
.mp b.man-ref {font-weight:normal;color:#434241}
|
||||
.mp pre {padding:0 4ex}
|
||||
.mp pre code {font-weight:normal;color:#434241}
|
||||
.mp h2+pre,h3+pre {padding-left:0}
|
||||
ol.man-decor,ol.man-decor li {margin:3px 0 10px 0;padding:0;float:left;width:33%;list-style-type:none;text-transform:uppercase;color:#999;letter-spacing:1px}
|
||||
ol.man-decor {width:100%}
|
||||
ol.man-decor li.tl {text-align:left}
|
||||
ol.man-decor li.tc {text-align:center;letter-spacing:4px}
|
||||
ol.man-decor li.tr {text-align:right;float:right}
|
||||
</style>
|
||||
</head>
|
||||
<!--
|
||||
The following styles are deprecated and will be removed at some point:
|
||||
div#man, div#man ol.man, div#man ol.head, div#man ol.man.
|
||||
|
||||
The .man-page, .man-decor, .man-head, .man-foot, .man-title, and
|
||||
.man-navigation should be used instead.
|
||||
-->
|
||||
<body id='manpage'>
|
||||
<div class='mp' id='man'>
|
||||
|
||||
<div class='man-navigation' style='display:none'>
|
||||
<a href="#NAME">NAME</a>
|
||||
<a href="#SYNOPSIS">SYNOPSIS</a>
|
||||
<a href="#DESCRIPTION">DESCRIPTION</a>
|
||||
<a href="#TPM2-BACK-END-CONFIGURATION">TPM2 back-end configuration</a>
|
||||
<a href="#AUTHOR">AUTHOR</a>
|
||||
<a href="#SPECIAL-THANKS">SPECIAL THANKS</a>
|
||||
<a href="#REPORTING-BUGS">REPORTING BUGS</a>
|
||||
<a href="#SEE-ALSO">SEE ALSO</a>
|
||||
</div>
|
||||
|
||||
<ol class='man-decor man-head man head'>
|
||||
<li class='tl'>zfs-tpm2-clear-key(8)</li>
|
||||
<li class='tc'></li>
|
||||
<li class='tr'>zfs-tpm2-clear-key(8)</li>
|
||||
</ol>
|
||||
|
||||
|
||||
|
||||
<h2 id="NAME">NAME</h2>
|
||||
<p class="man-name">
|
||||
<code>zfs-tpm2-clear-key</code> - <span class="man-whatis">rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata</span>
|
||||
</p>
|
||||
<h2 id="SYNOPSIS">SYNOPSIS</h2>
|
||||
|
||||
<p><code>zfs-tpm2-clear-key</code> <var>dataset</var></p>
|
||||
|
||||
<h2 id="DESCRIPTION">DESCRIPTION</h2>
|
||||
|
||||
<p><a class="man-ref" href="zfs-tpm2-clear-key.8.html">zfs-tpm2-clear-key<span class="s">(8)</span></a>, after verifying that <code>dataset</code> was encrypted with tzpfms backend <em>TPM2</em> will:</p>
|
||||
|
||||
<ol>
|
||||
<li>perform the equivalent of <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key -o keylocation=prompt -o keyformat=passphrase dataset</strong>,</li>
|
||||
<li>free the sealed key previously used to encrypt <code>dataset</code>,</li>
|
||||
<li>remove the <code>xyz.nabijaczleweli:tzpfms.{backend,key}</code> properties from <code>dataset</code>.</li>
|
||||
</ol>
|
||||
|
||||
<p>See <a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a> for a detailed description.</p>
|
||||
|
||||
<h2 id="TPM2-back-end-configuration">TPM2 back-end configuration</h2>
|
||||
|
||||
<h3 id="Environment-variables">Environment variables</h3>
|
||||
|
||||
<dl>
|
||||
<dt>
|
||||
<code>TSS2_LOG</code>=</dt>
|
||||
<dd>Any of: <em>NONE</em>, <em>ERROR</em>, <em>WARNING</em>, <em>INFO</em>, <em>DEBUG</em>, <em>TRACE</em>. Default: <em>WARNING</em>.</dd>
|
||||
</dl>
|
||||
|
||||
<h3 id="TPM-selection">TPM selection</h3>
|
||||
|
||||
<p>The library <code>libtss2-tcti-default.so</code> can be linked to any of the <code>libtss2-tcti-*.so</code> libraries to select the default,
|
||||
otherwise <code>/dev/tpmrm0</code>, then <code>/dev/tpm0</code>, then <code>localhost:2321</code> will be tried, in order (see <a class="man-ref" href="https://www.mankier.com/3/ESYS_CONTEXT">ESYS_CONTEXT<span class="s">(3)</span></a>).</p>
|
||||
|
||||
<h3 id="See-also">See also</h3>
|
||||
|
||||
<p>The tpm2-tss git repository at <a href="https://github.com/tpm2-software/tpm2-tss" data-bare-link="true">https://github.com/tpm2-software/tpm2-tss</a> and the documentation at <a href="https://tpm2-tss.readthedocs.io" data-bare-link="true">https://tpm2-tss.readthedocs.io</a>.</p>
|
||||
|
||||
<p>The TPM 2.0 specifications, mainly at <<a href="https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf" data-bare-link="true">https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf</a>> and related pages.</p>
|
||||
|
||||
<h2 id="AUTHOR">AUTHOR</h2>
|
||||
|
||||
<p>Written by наб <<a href="mailto:nabijaczleweli@nabijaczleweli.xyz" data-bare-link="true">nabijaczleweli@nabijaczleweli.xyz</a>></p>
|
||||
|
||||
<h2 id="SPECIAL-THANKS">SPECIAL THANKS</h2>
|
||||
|
||||
<p>To all who support further development, in particular:</p>
|
||||
|
||||
<ul>
|
||||
<li>ThePhD</li>
|
||||
<li>Embark Studios</li>
|
||||
</ul>
|
||||
|
||||
<h2 id="REPORTING-BUGS">REPORTING BUGS</h2>
|
||||
|
||||
<p><<a href="https://todo.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://todo.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<p><<a href="mailto:~nabijaczleweli/tzpfms@lists.sr.ht" data-bare-link="true">~nabijaczleweli/tzpfms@lists.sr.ht</a>>, archived at <<a href="https://lists.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://lists.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<h2 id="SEE-ALSO">SEE ALSO</h2>
|
||||
|
||||
<p><<a href="https://git.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://git.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<ol class='man-decor man-foot man foot'>
|
||||
<li class='tl'>tzpfms developers</li>
|
||||
<li class='tc'>October 2020</li>
|
||||
<li class='tr'>zfs-tpm2-clear-key(8)</li>
|
||||
</ol>
|
||||
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
66
zfs-tpm2-clear-key.8.html_fragment
Normal file
66
zfs-tpm2-clear-key.8.html_fragment
Normal file
@ -0,0 +1,66 @@
|
||||
<div class='mp'>
|
||||
|
||||
<h2 id="NAME">NAME</h2>
|
||||
<p class="man-name">
|
||||
<code>zfs-tpm2-clear-key</code> - <span class="man-whatis">rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata</span>
|
||||
</p>
|
||||
<h2 id="SYNOPSIS">SYNOPSIS</h2>
|
||||
|
||||
<p><code>zfs-tpm2-clear-key</code> <var>dataset</var></p>
|
||||
|
||||
<h2 id="DESCRIPTION">DESCRIPTION</h2>
|
||||
|
||||
<p><a class="man-ref" href="zfs-tpm2-clear-key.8.html">zfs-tpm2-clear-key<span class="s">(8)</span></a>, after verifying that <code>dataset</code> was encrypted with tzpfms backend <em>TPM2</em> will:</p>
|
||||
|
||||
<ol>
|
||||
<li>perform the equivalent of <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> change-key -o keylocation=prompt -o keyformat=passphrase dataset</strong>,</li>
|
||||
<li>free the sealed key previously used to encrypt <code>dataset</code>,</li>
|
||||
<li>remove the <code>xyz.nabijaczleweli:tzpfms.{backend,key}</code> properties from <code>dataset</code>.</li>
|
||||
</ol>
|
||||
|
||||
<p>See <a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a> for a detailed description.</p>
|
||||
|
||||
<h2 id="TPM2-back-end-configuration">TPM2 back-end configuration</h2>
|
||||
|
||||
<h3 id="Environment-variables">Environment variables</h3>
|
||||
|
||||
<dl>
|
||||
<dt>
|
||||
<code>TSS2_LOG</code>=</dt>
|
||||
<dd>Any of: <em>NONE</em>, <em>ERROR</em>, <em>WARNING</em>, <em>INFO</em>, <em>DEBUG</em>, <em>TRACE</em>. Default: <em>WARNING</em>.</dd>
|
||||
</dl>
|
||||
|
||||
<h3 id="TPM-selection">TPM selection</h3>
|
||||
|
||||
<p>The library <code>libtss2-tcti-default.so</code> can be linked to any of the <code>libtss2-tcti-*.so</code> libraries to select the default,
|
||||
otherwise <code>/dev/tpmrm0</code>, then <code>/dev/tpm0</code>, then <code>localhost:2321</code> will be tried, in order (see <a class="man-ref" href="https://www.mankier.com/3/ESYS_CONTEXT">ESYS_CONTEXT<span class="s">(3)</span></a>).</p>
|
||||
|
||||
<h3 id="See-also">See also</h3>
|
||||
|
||||
<p>The tpm2-tss git repository at <a href="https://github.com/tpm2-software/tpm2-tss" data-bare-link="true">https://github.com/tpm2-software/tpm2-tss</a> and the documentation at <a href="https://tpm2-tss.readthedocs.io" data-bare-link="true">https://tpm2-tss.readthedocs.io</a>.</p>
|
||||
|
||||
<p>The TPM 2.0 specifications, mainly at <<a href="https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf" data-bare-link="true">https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf</a>> and related pages.</p>
|
||||
|
||||
<h2 id="AUTHOR">AUTHOR</h2>
|
||||
|
||||
<p>Written by наб <<a href="mailto:nabijaczleweli@nabijaczleweli.xyz" data-bare-link="true">nabijaczleweli@nabijaczleweli.xyz</a>></p>
|
||||
|
||||
<h2 id="SPECIAL-THANKS">SPECIAL THANKS</h2>
|
||||
|
||||
<p>To all who support further development, in particular:</p>
|
||||
|
||||
<ul>
|
||||
<li>ThePhD</li>
|
||||
<li>Embark Studios</li>
|
||||
</ul>
|
||||
|
||||
<h2 id="REPORTING-BUGS">REPORTING BUGS</h2>
|
||||
|
||||
<p><<a href="https://todo.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://todo.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<p><<a href="mailto:~nabijaczleweli/tzpfms@lists.sr.ht" data-bare-link="true">~nabijaczleweli/tzpfms@lists.sr.ht</a>>, archived at <<a href="https://lists.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://lists.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<h2 id="SEE-ALSO">SEE ALSO</h2>
|
||||
|
||||
<p><<a href="https://git.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://git.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
</div>
|
||||
55
zfs-tpm2-clear-key.md
Normal file
55
zfs-tpm2-clear-key.md
Normal file
@ -0,0 +1,55 @@
|
||||
zfs-tpm2-clear-key(8) -- rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata
|
||||
===========================================================================================
|
||||
|
||||
## SYNOPSIS
|
||||
|
||||
`zfs-tpm2-clear-key` <dataset>
|
||||
|
||||
## DESCRIPTION
|
||||
|
||||
zfs-tpm2-clear-key(8), after verifying that `dataset` was encrypted with tzpfms backend *TPM2* will:
|
||||
|
||||
1. perform the equivalent of **zfs(8) change-key -o keylocation=prompt -o keyformat=passphrase dataset**,
|
||||
2. free the sealed key previously used to encrypt `dataset`,
|
||||
3. remove the `xyz.nabijaczleweli:tzpfms.{backend,key}` properties from `dataset`.
|
||||
|
||||
See zfs-tpm2-change-key(8) for a detailed description.
|
||||
|
||||
## TPM2 back-end configuration
|
||||
|
||||
### Environment variables
|
||||
|
||||
* `TSS2_LOG`=:
|
||||
Any of: *NONE*, *ERROR*, *WARNING*, *INFO*, *DEBUG*, *TRACE*. Default: *WARNING*.
|
||||
|
||||
### TPM selection
|
||||
|
||||
The library `libtss2-tcti-default.so` can be linked to any of the `libtss2-tcti-*.so` libraries to select the default,
|
||||
otherwise `/dev/tpmrm0`, then `/dev/tpm0`, then `localhost:2321` will be tried, in order (see ESYS_CONTEXT(3)).
|
||||
|
||||
### See also
|
||||
|
||||
The tpm2-tss git repository at <https://github.com/tpm2-software/tpm2-tss> and the documentation at <https://tpm2-tss.readthedocs.io>.
|
||||
|
||||
The TPM 2.0 specifications, mainly at <<https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf>> and related pages.
|
||||
|
||||
## AUTHOR
|
||||
|
||||
Written by наб <<nabijaczleweli@nabijaczleweli.xyz>>
|
||||
|
||||
## SPECIAL THANKS
|
||||
|
||||
To all who support further development, in particular:
|
||||
|
||||
* ThePhD
|
||||
* Embark Studios
|
||||
|
||||
## REPORTING BUGS
|
||||
|
||||
<<https://todo.sr.ht/~nabijaczleweli/tzpfms>>
|
||||
|
||||
<<mailto:~nabijaczleweli/tzpfms@lists.sr.ht>>, archived at <<https://lists.sr.ht/~nabijaczleweli/tzpfms>>
|
||||
|
||||
## SEE ALSO
|
||||
|
||||
<<https://git.sr.ht/~nabijaczleweli/tzpfms>>
|
||||
41
zfs-tpm2-load-key.8
Normal file
41
zfs-tpm2-load-key.8
Normal file
@ -0,0 +1,41 @@
|
||||
.\" generated with Ronn-NG/v0.9.1
|
||||
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
|
||||
.TH "ZFS\-TPM2\-LOAD\-KEY" "8" "October 2020" "tzpfms developers"
|
||||
.SH "NAME"
|
||||
\fBzfs\-tpm2\-load\-key\fR \- load tzpfms TPM2\-encrypted ZFS dataset key
|
||||
.SH "SYNOPSIS"
|
||||
\fBzfs\-tpm2\-load\-key\fR [\-n] \fIdataset\fR
|
||||
.SH "DESCRIPTION"
|
||||
zfs\-tpm2\-load\-key(8), after verifying that \fBdataset\fR was encrypted with tzpfms backend \fITPM2\fR will unseal the key and load it into \fBdataset\fR\.
|
||||
.P
|
||||
See zfs\-tpm2\-change\-key(8) for a detailed description\.
|
||||
.SH "OPTIONS"
|
||||
.TP
|
||||
\fB\-n\fR
|
||||
Do a no\-op/dry run, can be used even if the key is already loaded\. Equivalent to \fBzfs(8) load\-key\fR\'s \fB\-n\fR option\.
|
||||
.SH "TPM2 back\-end configuration"
|
||||
.SS "Environment variables"
|
||||
.TP
|
||||
\fBTSS2_LOG\fR=
|
||||
Any of: \fINONE\fR, \fIERROR\fR, \fIWARNING\fR, \fIINFO\fR, \fIDEBUG\fR, \fITRACE\fR\. Default: \fIWARNING\fR\.
|
||||
.SS "TPM selection"
|
||||
The library \fBlibtss2\-tcti\-default\.so\fR can be linked to any of the \fBlibtss2\-tcti\-*\.so\fR libraries to select the default, otherwise \fB/dev/tpmrm0\fR, then \fB/dev/tpm0\fR, then \fBlocalhost:2321\fR will be tried, in order (see ESYS_CONTEXT(3))\.
|
||||
.SS "See also"
|
||||
The tpm2\-tss git repository at \fIhttps://github\.com/tpm2\-software/tpm2\-tss\fR and the documentation at \fIhttps://tpm2\-tss\.readthedocs\.io\fR\.
|
||||
.P
|
||||
The TPM 2\.0 specifications, mainly at <\fIhttps://trustedcomputinggroup\.org/wp\-content/uploads/TPM\-Rev\-2\.0\-Part\-1\-Architecture\-01\.38\.pdf\fR> and related pages\.
|
||||
.SH "AUTHOR"
|
||||
Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR>
|
||||
.SH "SPECIAL THANKS"
|
||||
To all who support further development, in particular:
|
||||
.IP "\[ci]" 4
|
||||
ThePhD
|
||||
.IP "\[ci]" 4
|
||||
Embark Studios
|
||||
.IP "" 0
|
||||
.SH "REPORTING BUGS"
|
||||
<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR>
|
||||
.P
|
||||
<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR>
|
||||
.SH "SEE ALSO"
|
||||
<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR>
|
||||
148
zfs-tpm2-load-key.8.html
Normal file
148
zfs-tpm2-load-key.8.html
Normal file
@ -0,0 +1,148 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv='content-type' content='text/html;charset=utf8'>
|
||||
<meta name='generator' content='Ronn-NG/v0.9.1 (http://github.com/apjanke/ronn-ng/tree/0.9.1)'>
|
||||
<title>zfs-tpm2-load-key(8) - load tzpfms TPM2-encrypted ZFS dataset key</title>
|
||||
<style type='text/css' media='all'>
|
||||
/* style: man */
|
||||
body#manpage {margin:0}
|
||||
.mp {max-width:100ex;padding:0 9ex 1ex 4ex}
|
||||
.mp p,.mp pre,.mp ul,.mp ol,.mp dl {margin:0 0 20px 0}
|
||||
.mp h2 {margin:10px 0 0 0}
|
||||
.mp > p,.mp > pre,.mp > ul,.mp > ol,.mp > dl {margin-left:8ex}
|
||||
.mp h3 {margin:0 0 0 4ex}
|
||||
.mp dt {margin:0;clear:left}
|
||||
.mp dt.flush {float:left;width:8ex}
|
||||
.mp dd {margin:0 0 0 9ex}
|
||||
.mp h1,.mp h2,.mp h3,.mp h4 {clear:left}
|
||||
.mp pre {margin-bottom:20px}
|
||||
.mp pre+h2,.mp pre+h3 {margin-top:22px}
|
||||
.mp h2+pre,.mp h3+pre {margin-top:5px}
|
||||
.mp img {display:block;margin:auto}
|
||||
.mp h1.man-title {display:none}
|
||||
.mp,.mp code,.mp pre,.mp tt,.mp kbd,.mp samp,.mp h3,.mp h4 {font-family:monospace;font-size:14px;line-height:1.42857142857143}
|
||||
.mp h2 {font-size:16px;line-height:1.25}
|
||||
.mp h1 {font-size:20px;line-height:2}
|
||||
.mp {text-align:justify;background:#fff}
|
||||
.mp,.mp code,.mp pre,.mp pre code,.mp tt,.mp kbd,.mp samp {color:#131211}
|
||||
.mp h1,.mp h2,.mp h3,.mp h4 {color:#030201}
|
||||
.mp u {text-decoration:underline}
|
||||
.mp code,.mp strong,.mp b {font-weight:bold;color:#131211}
|
||||
.mp em,.mp var {font-style:italic;color:#232221;text-decoration:none}
|
||||
.mp a,.mp a:link,.mp a:hover,.mp a code,.mp a pre,.mp a tt,.mp a kbd,.mp a samp {color:#0000ff}
|
||||
.mp b.man-ref {font-weight:normal;color:#434241}
|
||||
.mp pre {padding:0 4ex}
|
||||
.mp pre code {font-weight:normal;color:#434241}
|
||||
.mp h2+pre,h3+pre {padding-left:0}
|
||||
ol.man-decor,ol.man-decor li {margin:3px 0 10px 0;padding:0;float:left;width:33%;list-style-type:none;text-transform:uppercase;color:#999;letter-spacing:1px}
|
||||
ol.man-decor {width:100%}
|
||||
ol.man-decor li.tl {text-align:left}
|
||||
ol.man-decor li.tc {text-align:center;letter-spacing:4px}
|
||||
ol.man-decor li.tr {text-align:right;float:right}
|
||||
</style>
|
||||
</head>
|
||||
<!--
|
||||
The following styles are deprecated and will be removed at some point:
|
||||
div#man, div#man ol.man, div#man ol.head, div#man ol.man.
|
||||
|
||||
The .man-page, .man-decor, .man-head, .man-foot, .man-title, and
|
||||
.man-navigation should be used instead.
|
||||
-->
|
||||
<body id='manpage'>
|
||||
<div class='mp' id='man'>
|
||||
|
||||
<div class='man-navigation' style='display:none'>
|
||||
<a href="#NAME">NAME</a>
|
||||
<a href="#SYNOPSIS">SYNOPSIS</a>
|
||||
<a href="#DESCRIPTION">DESCRIPTION</a>
|
||||
<a href="#OPTIONS">OPTIONS</a>
|
||||
<a href="#TPM2-BACK-END-CONFIGURATION">TPM2 back-end configuration</a>
|
||||
<a href="#AUTHOR">AUTHOR</a>
|
||||
<a href="#SPECIAL-THANKS">SPECIAL THANKS</a>
|
||||
<a href="#REPORTING-BUGS">REPORTING BUGS</a>
|
||||
<a href="#SEE-ALSO">SEE ALSO</a>
|
||||
</div>
|
||||
|
||||
<ol class='man-decor man-head man head'>
|
||||
<li class='tl'>zfs-tpm2-load-key(8)</li>
|
||||
<li class='tc'></li>
|
||||
<li class='tr'>zfs-tpm2-load-key(8)</li>
|
||||
</ol>
|
||||
|
||||
|
||||
|
||||
<h2 id="NAME">NAME</h2>
|
||||
<p class="man-name">
|
||||
<code>zfs-tpm2-load-key</code> - <span class="man-whatis">load tzpfms TPM2-encrypted ZFS dataset key</span>
|
||||
</p>
|
||||
<h2 id="SYNOPSIS">SYNOPSIS</h2>
|
||||
|
||||
<p><code>zfs-tpm2-load-key</code> [-n] <var>dataset</var></p>
|
||||
|
||||
<h2 id="DESCRIPTION">DESCRIPTION</h2>
|
||||
|
||||
<p><a class="man-ref" href="zfs-tpm2-load-key.8.html">zfs-tpm2-load-key<span class="s">(8)</span></a>, after verifying that <code>dataset</code> was encrypted with tzpfms backend <em>TPM2</em> will unseal the key and load it into <code>dataset</code>.</p>
|
||||
|
||||
<p>See <a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a> for a detailed description.</p>
|
||||
|
||||
<h2 id="OPTIONS">OPTIONS</h2>
|
||||
|
||||
<dl>
|
||||
<dt><code>-n</code></dt>
|
||||
<dd>Do a no-op/dry run, can be used even if the key is already loaded. Equivalent to <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> load-key</strong>'s <code>-n</code> option.</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="TPM2-back-end-configuration">TPM2 back-end configuration</h2>
|
||||
|
||||
<h3 id="Environment-variables">Environment variables</h3>
|
||||
|
||||
<dl>
|
||||
<dt>
|
||||
<code>TSS2_LOG</code>=</dt>
|
||||
<dd>Any of: <em>NONE</em>, <em>ERROR</em>, <em>WARNING</em>, <em>INFO</em>, <em>DEBUG</em>, <em>TRACE</em>. Default: <em>WARNING</em>.</dd>
|
||||
</dl>
|
||||
|
||||
<h3 id="TPM-selection">TPM selection</h3>
|
||||
|
||||
<p>The library <code>libtss2-tcti-default.so</code> can be linked to any of the <code>libtss2-tcti-*.so</code> libraries to select the default,
|
||||
otherwise <code>/dev/tpmrm0</code>, then <code>/dev/tpm0</code>, then <code>localhost:2321</code> will be tried, in order (see <a class="man-ref" href="https://www.mankier.com/3/ESYS_CONTEXT">ESYS_CONTEXT<span class="s">(3)</span></a>).</p>
|
||||
|
||||
<h3 id="See-also">See also</h3>
|
||||
|
||||
<p>The tpm2-tss git repository at <a href="https://github.com/tpm2-software/tpm2-tss" data-bare-link="true">https://github.com/tpm2-software/tpm2-tss</a> and the documentation at <a href="https://tpm2-tss.readthedocs.io" data-bare-link="true">https://tpm2-tss.readthedocs.io</a>.</p>
|
||||
|
||||
<p>The TPM 2.0 specifications, mainly at <<a href="https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf" data-bare-link="true">https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf</a>> and related pages.</p>
|
||||
|
||||
<h2 id="AUTHOR">AUTHOR</h2>
|
||||
|
||||
<p>Written by наб <<a href="mailto:nabijaczleweli@nabijaczleweli.xyz" data-bare-link="true">nabijaczleweli@nabijaczleweli.xyz</a>></p>
|
||||
|
||||
<h2 id="SPECIAL-THANKS">SPECIAL THANKS</h2>
|
||||
|
||||
<p>To all who support further development, in particular:</p>
|
||||
|
||||
<ul>
|
||||
<li>ThePhD</li>
|
||||
<li>Embark Studios</li>
|
||||
</ul>
|
||||
|
||||
<h2 id="REPORTING-BUGS">REPORTING BUGS</h2>
|
||||
|
||||
<p><<a href="https://todo.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://todo.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<p><<a href="mailto:~nabijaczleweli/tzpfms@lists.sr.ht" data-bare-link="true">~nabijaczleweli/tzpfms@lists.sr.ht</a>>, archived at <<a href="https://lists.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://lists.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<h2 id="SEE-ALSO">SEE ALSO</h2>
|
||||
|
||||
<p><<a href="https://git.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://git.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<ol class='man-decor man-foot man foot'>
|
||||
<li class='tl'>tzpfms developers</li>
|
||||
<li class='tc'>October 2020</li>
|
||||
<li class='tr'>zfs-tpm2-load-key(8)</li>
|
||||
</ol>
|
||||
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
67
zfs-tpm2-load-key.8.html_fragment
Normal file
67
zfs-tpm2-load-key.8.html_fragment
Normal file
@ -0,0 +1,67 @@
|
||||
<div class='mp'>
|
||||
|
||||
<h2 id="NAME">NAME</h2>
|
||||
<p class="man-name">
|
||||
<code>zfs-tpm2-load-key</code> - <span class="man-whatis">load tzpfms TPM2-encrypted ZFS dataset key</span>
|
||||
</p>
|
||||
<h2 id="SYNOPSIS">SYNOPSIS</h2>
|
||||
|
||||
<p><code>zfs-tpm2-load-key</code> [-n] <var>dataset</var></p>
|
||||
|
||||
<h2 id="DESCRIPTION">DESCRIPTION</h2>
|
||||
|
||||
<p><a class="man-ref" href="zfs-tpm2-load-key.8.html">zfs-tpm2-load-key<span class="s">(8)</span></a>, after verifying that <code>dataset</code> was encrypted with tzpfms backend <em>TPM2</em> will unseal the key and load it into <code>dataset</code>.</p>
|
||||
|
||||
<p>See <a class="man-ref" href="zfs-tpm2-change-key.8.html">zfs-tpm2-change-key<span class="s">(8)</span></a> for a detailed description.</p>
|
||||
|
||||
<h2 id="OPTIONS">OPTIONS</h2>
|
||||
|
||||
<dl>
|
||||
<dt><code>-n</code></dt>
|
||||
<dd>Do a no-op/dry run, can be used even if the key is already loaded. Equivalent to <strong><a class="man-ref" href="https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html">zfs<span class="s">(8)</span></a> load-key</strong>'s <code>-n</code> option.</dd>
|
||||
</dl>
|
||||
|
||||
<h2 id="TPM2-back-end-configuration">TPM2 back-end configuration</h2>
|
||||
|
||||
<h3 id="Environment-variables">Environment variables</h3>
|
||||
|
||||
<dl>
|
||||
<dt>
|
||||
<code>TSS2_LOG</code>=</dt>
|
||||
<dd>Any of: <em>NONE</em>, <em>ERROR</em>, <em>WARNING</em>, <em>INFO</em>, <em>DEBUG</em>, <em>TRACE</em>. Default: <em>WARNING</em>.</dd>
|
||||
</dl>
|
||||
|
||||
<h3 id="TPM-selection">TPM selection</h3>
|
||||
|
||||
<p>The library <code>libtss2-tcti-default.so</code> can be linked to any of the <code>libtss2-tcti-*.so</code> libraries to select the default,
|
||||
otherwise <code>/dev/tpmrm0</code>, then <code>/dev/tpm0</code>, then <code>localhost:2321</code> will be tried, in order (see <a class="man-ref" href="https://www.mankier.com/3/ESYS_CONTEXT">ESYS_CONTEXT<span class="s">(3)</span></a>).</p>
|
||||
|
||||
<h3 id="See-also">See also</h3>
|
||||
|
||||
<p>The tpm2-tss git repository at <a href="https://github.com/tpm2-software/tpm2-tss" data-bare-link="true">https://github.com/tpm2-software/tpm2-tss</a> and the documentation at <a href="https://tpm2-tss.readthedocs.io" data-bare-link="true">https://tpm2-tss.readthedocs.io</a>.</p>
|
||||
|
||||
<p>The TPM 2.0 specifications, mainly at <<a href="https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf" data-bare-link="true">https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf</a>> and related pages.</p>
|
||||
|
||||
<h2 id="AUTHOR">AUTHOR</h2>
|
||||
|
||||
<p>Written by наб <<a href="mailto:nabijaczleweli@nabijaczleweli.xyz" data-bare-link="true">nabijaczleweli@nabijaczleweli.xyz</a>></p>
|
||||
|
||||
<h2 id="SPECIAL-THANKS">SPECIAL THANKS</h2>
|
||||
|
||||
<p>To all who support further development, in particular:</p>
|
||||
|
||||
<ul>
|
||||
<li>ThePhD</li>
|
||||
<li>Embark Studios</li>
|
||||
</ul>
|
||||
|
||||
<h2 id="REPORTING-BUGS">REPORTING BUGS</h2>
|
||||
|
||||
<p><<a href="https://todo.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://todo.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<p><<a href="mailto:~nabijaczleweli/tzpfms@lists.sr.ht" data-bare-link="true">~nabijaczleweli/tzpfms@lists.sr.ht</a>>, archived at <<a href="https://lists.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://lists.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
|
||||
<h2 id="SEE-ALSO">SEE ALSO</h2>
|
||||
|
||||
<p><<a href="https://git.sr.ht/~nabijaczleweli/tzpfms" data-bare-link="true">https://git.sr.ht/~nabijaczleweli/tzpfms</a>></p>
|
||||
</div>
|
||||
56
zfs-tpm2-load-key.md
Normal file
56
zfs-tpm2-load-key.md
Normal file
@ -0,0 +1,56 @@
|
||||
zfs-tpm2-load-key(8) -- load tzpfms TPM2-encrypted ZFS dataset key
|
||||
==================================================================
|
||||
|
||||
## SYNOPSIS
|
||||
|
||||
`zfs-tpm2-load-key` [-n] <dataset>
|
||||
|
||||
## DESCRIPTION
|
||||
|
||||
zfs-tpm2-load-key(8), after verifying that `dataset` was encrypted with tzpfms backend *TPM2* will unseal the key and load it into `dataset`.
|
||||
|
||||
See zfs-tpm2-change-key(8) for a detailed description.
|
||||
|
||||
## OPTIONS
|
||||
|
||||
* `-n`:
|
||||
Do a no-op/dry run, can be used even if the key is already loaded. Equivalent to **zfs(8) load-key**'s `-n` option.
|
||||
|
||||
## TPM2 back-end configuration
|
||||
|
||||
### Environment variables
|
||||
|
||||
* `TSS2_LOG`=:
|
||||
Any of: *NONE*, *ERROR*, *WARNING*, *INFO*, *DEBUG*, *TRACE*. Default: *WARNING*.
|
||||
|
||||
### TPM selection
|
||||
|
||||
The library `libtss2-tcti-default.so` can be linked to any of the `libtss2-tcti-*.so` libraries to select the default,
|
||||
otherwise `/dev/tpmrm0`, then `/dev/tpm0`, then `localhost:2321` will be tried, in order (see ESYS_CONTEXT(3)).
|
||||
|
||||
### See also
|
||||
|
||||
The tpm2-tss git repository at <https://github.com/tpm2-software/tpm2-tss> and the documentation at <https://tpm2-tss.readthedocs.io>.
|
||||
|
||||
The TPM 2.0 specifications, mainly at <<https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf>> and related pages.
|
||||
|
||||
## AUTHOR
|
||||
|
||||
Written by наб <<nabijaczleweli@nabijaczleweli.xyz>>
|
||||
|
||||
## SPECIAL THANKS
|
||||
|
||||
To all who support further development, in particular:
|
||||
|
||||
* ThePhD
|
||||
* Embark Studios
|
||||
|
||||
## REPORTING BUGS
|
||||
|
||||
<<https://todo.sr.ht/~nabijaczleweli/tzpfms>>
|
||||
|
||||
<<mailto:~nabijaczleweli/tzpfms@lists.sr.ht>>, archived at <<https://lists.sr.ht/~nabijaczleweli/tzpfms>>
|
||||
|
||||
## SEE ALSO
|
||||
|
||||
<<https://git.sr.ht/~nabijaczleweli/tzpfms>>
|
||||
Loading…
x
Reference in New Issue
Block a user