diff --git a/index.txt b/index.txt deleted file mode 100644 index 8902381..0000000 --- a/index.txt +++ /dev/null @@ -1,13 +0,0 @@ -zfs-tpm2-change-key(8) zfs-tpm2-change-key.8.ronn -zfs-tpm2-load-key(8) zfs-tpm2-load-key.8.ronn -zfs-tpm2-clear-key(8) zfs-tpm2-clear-key.8.ronn -zfs-tpm1x-change-key(8) zfs-tpm1x-change-key.8.ronn -zfs-tpm1x-load-key(8) zfs-tpm1x-load-key.8.ronn -zfs-tpm1x-clear-key(8) zfs-tpm1x-clear-key.8.ronn -zfs-tpm-list(8) zfs-tpm-list.8.ronn - -zfs(8) https://manpages.debian.org/bullseye/zfsutils-linux/zfs.8.en.html -tcsd(8) https://manpages.debian.org/bullseye/trousers/tcsd.8.en.html -tpm2_unseal(1) https://manpages.debian.org/bullseye/tpm2-tools/tpm2_unseal.1.en.html - -ESYS_CONTEXT(3) https://www.mankier.com/3/ESYS_CONTEXT diff --git a/style.css b/style.css new file mode 100644 index 0000000..98c78fe --- /dev/null +++ b/style.css @@ -0,0 +1,297 @@ +/* $OpenBSD: mandoc.css,v 1.33 2019/06/02 16:50:46 schwarze Exp $ */ +/* + * Standard style sheet for mandoc(1) -Thtml and man.cgi(8). + * + * Written by Ingo Schwarze . + * I place this file into the public domain. + * Permission to use, copy, modify, and distribute it for any purpose + * with or without fee is hereby granted, without any conditions. + */ +/* Tooltips removed. */ + +/* Global defaults. */ + +html { max-width: 65em; + --bg: #FFFFFF; + --fg: #000000; } +body { background: var(--bg); + color: var(--fg); + font-family: Helvetica,Arial,sans-serif; } +h1 { font-size: 110%; } +table { margin-top: 0em; + margin-bottom: 0em; + border-collapse: collapse; } +/* Some browsers set border-color in a browser style for tbody, + * but not for table, resulting in inconsistent border styling. */ +tbody { border-color: inherit; } +tr { border-color: inherit; } +td { vertical-align: top; + padding-left: 0.2em; + padding-right: 0.2em; + border-color: inherit; } +ul, ol, dl { margin-top: 0em; + margin-bottom: 0em; } +li, dt { margin-top: 1em; } + +.permalink { border-bottom: thin dotted; + color: inherit; + font: inherit; + text-decoration: inherit; } +* { clear: both } + +/* Search form and search results. */ + +fieldset { border: thin solid silver; + border-radius: 1em; + text-align: center; } +input[name=expr] { + width: 25%; } + +table.results { margin-top: 1em; + margin-left: 2em; + font-size: smaller; } + +/* Header and footer lines. */ + +table.head { width: 100%; + border-bottom: 1px dotted #808080; + margin-bottom: 1em; + font-size: smaller; } +td.head-vol { text-align: center; } +td.head-rtitle { + text-align: right; } + +table.foot { width: 100%; + border-top: 1px dotted #808080; + margin-top: 1em; + font-size: smaller; } +td.foot-os { text-align: right; } + +/* Sections and paragraphs. */ + +.manual-text { + margin-left: 3.8em; } +.Nd { } +section.Sh { } +h1.Sh { margin-top: 1.2em; + margin-bottom: 0.6em; + margin-left: -3.2em; } +section.Ss { } +h2.Ss { margin-top: 1.2em; + margin-bottom: 0.6em; + margin-left: -1.2em; + font-size: 105%; } +.Pp { margin: 0.6em 0em; } +.Sx { } +.Xr { } + +/* Displays and lists. */ + +.Bd { } +.Bd-indent { margin-left: 3.8em; } + +.Bl-bullet { list-style-type: disc; + padding-left: 1em; } +.Bl-bullet > li { } +.Bl-dash { list-style-type: none; + padding-left: 0em; } +.Bl-dash > li:before { + content: "\2014 "; } +.Bl-item { list-style-type: none; + padding-left: 0em; } +.Bl-item > li { } +.Bl-compact > li { + margin-top: 0em; } + +.Bl-enum { padding-left: 2em; } +.Bl-enum > li { } +.Bl-compact > li { + margin-top: 0em; } + +.Bl-diag { } +.Bl-diag > dt { + font-style: normal; + font-weight: bold; } +.Bl-diag > dd { + margin-left: 0em; } +.Bl-hang { } +.Bl-hang > dt { } +.Bl-hang > dd { + margin-left: 5.5em; } +.Bl-inset { } +.Bl-inset > dt { } +.Bl-inset > dd { + margin-left: 0em; } +.Bl-ohang { } +.Bl-ohang > dt { } +.Bl-ohang > dd { + margin-left: 0em; } +.Bl-tag { margin-top: 0.6em; + margin-left: 5.5em; } +.Bl-tag > dt { + float: left; + margin-top: 0em; + margin-left: -5.5em; + padding-right: 0.5em; + vertical-align: top; } +.Bl-tag > dd { + clear: right; + column-count: 1; /* Force block formatting context. */ + width: 100%; + margin-top: 0em; + margin-left: 0em; + margin-bottom: 0.6em; + vertical-align: top; } +.Bl-compact { margin-top: 0em; } +.Bl-compact > dd { + margin-bottom: 0em; } +.Bl-compact > dt { + margin-top: 0em; } + +.Bl-column { } +.Bl-column > tbody > tr { } +.Bl-column > tbody > tr > td { + margin-top: 1em; } +.Bl-compact > tbody > tr > td { + margin-top: 0em; } + +.Rs { font-style: normal; + font-weight: normal; } +.RsA { } +.RsB { font-style: italic; + font-weight: normal; } +.RsC { } +.RsD { } +.RsI { font-style: italic; + font-weight: normal; } +.RsJ { font-style: italic; + font-weight: normal; } +.RsN { } +.RsO { } +.RsP { } +.RsQ { } +.RsR { } +.RsT { text-decoration: underline; } +.RsU { } +.RsV { } + +.eqn { } +.tbl td { vertical-align: middle; } + +.HP { margin-left: 3.8em; + text-indent: -3.8em; } + +/* Semantic markup for command line utilities. */ + +table.Nm { } +code.Nm { font-style: normal; + font-weight: bold; + font-family: monospace; } +.Fl { font-style: normal; + font-weight: bold; + font-family: monospace; } +.Cm { font-style: normal; + font-weight: bold; + font-family: monospace; } +.Ar { font-style: italic; + font-weight: normal; + font-family: monospace; } +.Op { display: inline; } +.Ic { font-style: normal; + font-weight: bold; + font-family: monospace; } +.Ev { font-style: normal; + font-weight: normal; + font-family: monospace; } +.Pa { font-style: italic; + font-weight: normal; } + +/* Semantic markup for function libraries. */ + +.Lb { } +code.In { font-style: normal; + font-weight: bold; + font-family: inherit; } +a.In { } +.Fd { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Ft { font-style: italic; + font-weight: normal; } +.Fn { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Fa { font-style: italic; + font-weight: normal; } +.Vt { font-style: italic; + font-weight: normal; } +.Va { font-style: italic; + font-weight: normal; } +.Dv { font-style: normal; + font-weight: normal; + font-family: monospace; } +.Er { font-style: normal; + font-weight: normal; + font-family: monospace; } + +/* Various semantic markup. */ + +.An { } +.Lk { } +.Mt { } +.Cd { font-style: normal; + font-weight: bold; + font-family: inherit; } +.Ad { font-style: italic; + font-weight: normal; } +.Ms { font-style: normal; + font-weight: bold; } +.St { } +.Ux { } + +/* Physical markup. */ + +.Bf { display: inline; } +.No { font-style: normal; + font-weight: normal; } +.Em { font-style: italic; + font-weight: normal; } +.Sy { font-style: normal; + font-weight: bold; } +.Li { font-style: normal; + font-weight: normal; + font-family: monospace; } + +/* Tooltip support. */ + +h1.Sh, h2.Ss { position: relative; } +.Li, .An, .Ar, .Cd, .Cm, .Dv, .Em, .Er, .Ev, .Fa, .Fd, .Fl, .Fn, .Ft, +.Ic, code.In, .Lb, .Lk, .Ms, .Mt, .Nd, code.Nm, .Pa, .Rs, +.St, .Sx, .Sy, .Va, .Vt, .Xr { + display: inline-block; + position: relative; } + +/* Overrides to avoid excessive margins on small devices. */ + +@media (max-width: 37.5em) { +.manual-text { + margin-left: 0.5em; } +h1.Sh, h2.Ss { margin-left: 0em; } +.Bd-indent { margin-left: 2em; } +.Bl-hang > dd { + margin-left: 2em; } +.Bl-tag { margin-left: 2em; } +.Bl-tag > dt { + margin-left: -2em; } +.HP { margin-left: 2em; + text-indent: -2em; } +} + +/* Overrides for a dark color scheme for accessibility. */ + +@media (prefers-color-scheme: dark) { +html { --bg: #1E1F21; + --fg: #EEEFF1; } +:link { color: #BAD7FF; } +:visited { color: #F6BAFF; } +} diff --git a/zfs-tpm-list.8 b/zfs-tpm-list.8 index 89e7c91..a6d2585 100644 --- a/zfs-tpm-list.8 +++ b/zfs-tpm-list.8 @@ -1,88 +1,135 @@ -.\" generated with Ronn-NG/v0.9.1 -.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 -.TH "ZFS\-TPM\-LIST" "8" "January 2021" "tzpfms developers" -.SH "NAME" -\fBzfs\-tpm\-list\fR \- print dataset tzpfms metadata -.SH "SYNOPSIS" -\fBzfs\-tpm\-list\fR [\-H] [\-r|\-d \fIdepth\fR] [\-a|\-b \fIback\-end\fR] [\-u|\-l] [\fIfilesystem\fR|\fIvolume\fR]… -.SH "DESCRIPTION" -zfs\-tpm\-list(8) lists the following properties on encryption roots: -.IP "\[ci]" 4 -\fBname\fR, -.IP "\[ci]" 4 -\fBback\-end\fR: the tzpfms back\-end (e\.g\. "TPM2" for zfs\-tpm2\-change\-key(8) or "TPM1\.X" for zfs\-tpm1x\-change\-key(8)), or "\-" if none is configured, -.IP "\[ci]" 4 -\fBkeystatus\fR: "available" or "unavailable", -.IP "\[ci]" 4 -\fBcoherent\fR: "yes" if either both \fBxyz\.nabijaczleweli:tzpfms\.backend\fR and \fBxyz\.nabijaczleweli:tzpfms\.key\fR are present or missing, "no" otherwise\. -.IP "" 0 -.P -Incoherent datasets require immediate operator attention, with either the appropriate zfs\-tpm*\-clear\-key program or zfs(8) change\-key and zfs(8) inherit \(em if the key becomes unloaded, they will require restoration from back\-up\. However, they should never occur, unless something went terribly wrong with the dataset properties\. -.P -If no datasets are specified, lists all matching encryption roots\. The default filter is to list all roots managed by tzpfms\. The \fB\-a\fR and \fB\-b\fR OPTIONS \fI\fR can be used to either list all roots or only ones backed by a particular end, respectively\. -.SH "OPTIONS" -.TP -\fB\-H\fR -Used for scripting mode\. Do not print headers and separate fields by a single tab instead of arbitrary white space\. -.TP -\fB\-r\fR -Recurse into all descendant datasets\. Default if no datasets listed on the command\-line\. -.TP -\fB\-d\fR \fIdepth\fR -Recurse at most \fIdepth\fR datasets deep\. Defaults to zero if datasets were listed on the command\-line\. -.TP -\fB\-a\fR -List all encryption roots, even ones not managed by tzpfms\. -.TP -\fB\-b\fR \fIback\-end\fR -List only encryption roots with tzpfms back\-end \fIback\-end\fR\. -.TP -\fB\-l\fR -List only encryption roots whose keys are available\. -.TP -\fB\-u\fR -List only encryption roots whose keys are unavailable\. -.SH "EXAMPLES" -.nf -$ zfs\-tpm\-list -NAME BACK\-END KEYSTATUS COHERENT -owo/venc TPM2 unavailable yes -owo/enc TPM1\.X available yes +.Dd October 15, 2021 +.ds doc-volume-operating-system +.Dt ZFS-TPM-LIST 8 +.Os tzpfms 0.1-5 +. +.Sh NAME +.Nm zfs-tpm-list +.Nd print dataset tzpfms metadata +.Sh SYNOPSIS +.Nm +.Op Fl H +.Op Fl r Ns \&| Ns Fl d Ar depth +.Op Fl a Ns \&| Ns Fl b Ar back-end +.Op Fl u Ns \&| Ns Fl l +.Oo Ar filesystem Ns \&| Ns Ar volume Oc Ns … +. +.Sh DESCRIPTION +Lists the following properties on encryption roots: +.Bl -tag -compact -offset Ds -width "keystatus" +.It Li name +.It Li back-end +the +.Nm tzpfms +back-end +.Pq e.g. Sy TPM2 No for Xr zfs-tpm2-change-key 8 or Sy TPM1.X No for Xr zfs-tpm1x-change-key 8 , +or +.Qq Sy - +if none is configured +.It Li keystatus +.Sy available +or +.Sy unavailable +.It Li coherent +.Sy yes +if either both +.Li xyz.nabijaczleweli:tzpfms.backend +and +.Li xyz.nabijaczleweli:tzpfms.key +are present or missing, +.Sy no +otherwise +.El +.Pp +Incoherent datasets require immediate operator attention, with either the appropriate +.Nm zfs-tpm*-clear-key +program or +.Nm zfs Cm change-key +and +.Nm zfs Cm inherit +\(em if the key becomes unloaded, they will require restoration from back-up. +However, they should never occur, unless something went terribly wrong with the dataset properties. +.Pp +If no datasets are specified, lists all matching encryption roots. +The default filter is to list all roots managed by +.Nm tzpfms . +.Fl ab +can be used to either list all roots or only ones backed by a particular end, respectively. +. +.Sh OPTIONS +.Bl -tag -compact -width "-b back-end" +.It Fl H +Scripting mode \(em do not print headers and separate fields by a single tab instead of columnating with spaces. +.Pp +.It Fl r +Recurse into all descendants of specified datasets. +.It Fl d Ar depth +Recurse at most +.Ar depth +datasets deep. +Default: +.Sy 0 . +.Pp +.It Fl a +List all encryption roots, even ones not managed by +.Nm tzpfms . +.It Fl b Ar back-end +List only encryption roots with +.Ar tzpfms +back-end +.Ar back-end . +.Pp +.It Fl l +List only encryption roots whose keys are available. +.It Fl y +List only encryption roots whose keys are unavailable. +.El +. +.Sh EXAMPLES +.Bd -literal -compact +.Li $ Nm +NAME BACK-END KEYSTATUS COHERENT +owo/venc TPM2 unavailable yes +owo/enc TPM1.X available yes -$ zfs\-tpm\-list \-ad0 -NAME BACK\-END KEYSTATUS COHERENT -awa \- available yes +.Li $ Nm Fl ad0 +NAME BACK-END KEYSTATUS COHERENT +awa - available yes -$ zfs\-tpm\-list \-b TPM2 -NAME BACK\-END KEYSTATUS COHERENT -owo/venc TPM2 unavailable yes +.Li $ Nm Fl b Sy TPM2 +NAME BACK-END KEYSTATUS COHERENT +owo/venc TPM2 unavailable yes -$ zfs\-tpm\-list \-ra owo -NAME BACK\-END KEYSTATUS COHERENT -owo/venc TPM2 unavailable yes -owo/vtnc \- available yes -owo/v nc \- available yes -owo/enc TPM1\.X available yes +.Li $ Nm Fl ra Ar owo +NAME BACK-END KEYSTATUS COHERENT +owo/venc TPM2 unavailable yes +owo/vtnc - available yes +owo/v nc - available yes +owo/enc TPM1.X available yes -$ zfs\-tpm\-list \-al -NAME BACK\-END KEYSTATUS COHERENT -awa \- available yes -owo/vtnc \- available yes -owo/v nc \- available yes -owo/enc TPM1\.X available yes -.fi -.SH "AUTHOR" -Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR> -.SH "SPECIAL THANKS" +.Li $ Nm Fl al +NAME BACK-END KEYSTATUS COHERENT +awa - available yes +owo/vtnc - available yes +owo/v nc - available yes +owo/enc TPM1.X available yes +.Ed +. +.Sh SPECIAL THANKS To all who support further development, in particular: -.IP "\[ci]" 4 +.Bl -bullet -offset 4n -compact -width 0 +.It ThePhD -.IP "\[ci]" 4 +.It Embark Studios -.IP "" 0 -.SH "REPORTING BUGS" -<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.P -<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.SH "SEE ALSO" -<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR> +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/~nabijaczleweli/tzpfms +.Pp +.Mt ~nabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/~nabijaczleweli/tzpfms . +. +.Sh SEE ALSO +.Lk https:/\&/git.sr.ht/~nabijaczleweli/tzpfms diff --git a/zfs-tpm-list.8.html b/zfs-tpm-list.8.html index ffd51a1..9a7169e 100644 --- a/zfs-tpm-list.8.html +++ b/zfs-tpm-list.8.html @@ -1,191 +1,175 @@ - - - zfs-tpm-list(8) - print dataset tzpfms metadata - + + + + ZFS-TPM-LIST(8) - - -
- - - -
    -
  1. zfs-tpm-list(8)
    2. -
  2. -
  3. zfs-tpm-list(8)
    4. -
- - - -

NAME

-

- zfs-tpm-list - print dataset tzpfms metadata -

-

SYNOPSIS

- -

zfs-tpm-list [-H] [-r|-d depth] [-a|-b back-end] [-u|-l] [filesystem|volume]…

- -

DESCRIPTION

- -

zfs-tpm-list(8) lists the following properties on encryption roots:

- - - -

Incoherent datasets require immediate operator attention, with either the appropriate zfs-tpm*-clear-key program or zfs(8) change-key and zfs(8) inherit — -if the key becomes unloaded, they will require restoration from back-up. -However, they should never occur, unless something went terribly wrong with the dataset properties.

- -

If no datasets are specified, lists all matching encryption roots. -The default filter is to list all roots managed by tzpfms. -The -a and -b OPTIONS can be used to either list all roots or only ones backed by a particular end, respectively.

- -

OPTIONS

- -
-
-H
-
Used for scripting mode. Do not print headers and separate fields by a single tab instead of arbitrary white space.
-
-r
-
Recurse into all descendant datasets. Default if no datasets listed on the command-line.
-
--d depth -
-
Recurse at most depth datasets deep. Defaults to zero if datasets were listed on the command-line.
-
-a
-
List all encryption roots, even ones not managed by tzpfms.
-
--b back-end -
-
List only encryption roots with tzpfms back-end back-end.
-
-l
-
List only encryption roots whose keys are available.
-
-u
-
List only encryption roots whose keys are unavailable.
+ + + + + + + +
ZFS-TPM-LIST(8)System Manager's ManualZFS-TPM-LIST(8)
+
+
+

+

zfs-tpm-list — + print dataset tzpfms metadata

+
+
+

+ + + + + +
zfs-tpm-list[-H] + [-r|-d + depth] + [-a|-b + back-end] + [-u|-l] + [filesystem|volume]…
+
+
+

+

Lists the following properties on encryption roots:

+
+
+
+
 
+
+
the tzpfms back-end (e.g. TPM2 + for + zfs-tpm2-change-key(8) + or + + for + zfs-tpm1x-change-key(8)), + or "-" if none is configured
+
+
+ or +
+
+
if + either both xyz.nabijaczleweli:tzpfms.backend and + xyz.nabijaczleweli:tzpfms.key are present or + missing, + otherwise
+
+

Incoherent datasets require immediate operator attention, with + either the appropriate zfs-tpm*-clear-key program or + zfs change-key and + zfs inherit — if the + key becomes unloaded, they will require restoration from back-up. However, + they should never occur, unless something went terribly wrong with the + dataset properties.

+

If no datasets are specified, lists all matching encryption roots. + The default filter is to list all roots managed by + tzpfms. -ab can be used to + either list all roots or only ones backed by a particular end, + respectively.

+
+
+

+
+
+
Scripting mode — do not print headers and separate fields by a + single tab instead of columnating with spaces. +

+
+
+
Recurse into all descendants of specified datasets.
+
+ depth
+
Recurse at most depth datasets deep. Default: + . +

+
+
+
List all encryption roots, even ones not managed by + tzpfms.
+
+ back-end
+
List only encryption roots with tzpfms back-end + back-end. +

+
+
+
List only encryption roots whose keys are available.
+
+
List only encryption roots whose keys are unavailable.
+
+
+
+

+
+
$
+zfs-tpm-list +NAME BACK-END KEYSTATUS COHERENT +owo/venc TPM2 unavailable yes +owo/enc TPM1.X available yes -

EXAMPLES

+$ zfs-tpm-list + -ad0 +NAME BACK-END KEYSTATUS COHERENT +awa - available yes -
$ zfs-tpm-list
-NAME      BACK-END  KEYSTATUS    COHERENT
-owo/venc  TPM2      unavailable  yes
-owo/enc   TPM1.X    available    yes
+$ zfs-tpm-list
+  -b TPM2
+NAME BACK-END KEYSTATUS COHERENT
+owo/venc TPM2 unavailable yes
 
-$ zfs-tpm-list -ad0
-NAME  BACK-END  KEYSTATUS  COHERENT
-awa   -         available  yes
+$ zfs-tpm-list
+  -ra owo
+NAME BACK-END KEYSTATUS COHERENT
+owo/venc TPM2 unavailable yes
+owo/vtnc - available yes
+owo/v nc - available yes
+owo/enc TPM1.X available yes
 
-$ zfs-tpm-list -b TPM2
-NAME      BACK-END  KEYSTATUS    COHERENT
-owo/venc  TPM2      unavailable  yes
-
-$ zfs-tpm-list -ra owo
-NAME      BACK-END  KEYSTATUS    COHERENT
-owo/venc  TPM2      unavailable  yes
-owo/vtnc  -         available    yes
-owo/v nc  -         available    yes
-owo/enc   TPM1.X    available    yes
-
-$ zfs-tpm-list -al
-NAME      BACK-END  KEYSTATUS  COHERENT
-awa       -         available  yes
-owo/vtnc  -         available  yes
-owo/v nc  -         available  yes
-owo/enc   TPM1.X    available  yes
-
- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- -
    +$ zfs-tpm-list + -al +NAME BACK-END KEYSTATUS COHERENT +awa - available yes +owo/vtnc - available yes +owo/v nc - available yes +owo/enc TPM1.X available yes
+
+
+

+

To all who support further development, in particular:

+
  • ThePhD
  • Embark Studios
- -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

- -
    -
  1. tzpfms developers
    2. -
  2. January 2021
    3. -
  3. zfs-tpm-list(8)
    4. -
- -
+ +
+

+

https://todo.sr.ht/~nabijaczleweli/tzpfms

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+
+

+

https://git.sr.ht/~nabijaczleweli/tzpfms

+
+
+ + + + + +
October 15, 2021tzpfms 0.1-5
diff --git a/zfs-tpm-list.8.html_fragment b/zfs-tpm-list.8.html_fragment deleted file mode 100644 index 9eb6d70..0000000 --- a/zfs-tpm-list.8.html_fragment +++ /dev/null @@ -1,110 +0,0 @@ -
- -

NAME

-

- zfs-tpm-list - print dataset tzpfms metadata -

-

SYNOPSIS

- -

zfs-tpm-list [-H] [-r|-d depth] [-a|-b back-end] [-u|-l] [filesystem|volume]…

- -

DESCRIPTION

- -

zfs-tpm-list(8) lists the following properties on encryption roots:

- - - -

Incoherent datasets require immediate operator attention, with either the appropriate zfs-tpm*-clear-key program or zfs(8) change-key and zfs(8) inherit — -if the key becomes unloaded, they will require restoration from back-up. -However, they should never occur, unless something went terribly wrong with the dataset properties.

- -

If no datasets are specified, lists all matching encryption roots. -The default filter is to list all roots managed by tzpfms. -The -a and -b OPTIONS can be used to either list all roots or only ones backed by a particular end, respectively.

- -

OPTIONS

- -
-
-H
-
Used for scripting mode. Do not print headers and separate fields by a single tab instead of arbitrary white space.
-
-r
-
Recurse into all descendant datasets. Default if no datasets listed on the command-line.
-
--d depth -
-
Recurse at most depth datasets deep. Defaults to zero if datasets were listed on the command-line.
-
-a
-
List all encryption roots, even ones not managed by tzpfms.
-
--b back-end -
-
List only encryption roots with tzpfms back-end back-end.
-
-l
-
List only encryption roots whose keys are available.
-
-u
-
List only encryption roots whose keys are unavailable.
-
- -

EXAMPLES

- -
$ zfs-tpm-list
-NAME      BACK-END  KEYSTATUS    COHERENT
-owo/venc  TPM2      unavailable  yes
-owo/enc   TPM1.X    available    yes
-
-$ zfs-tpm-list -ad0
-NAME  BACK-END  KEYSTATUS  COHERENT
-awa   -         available  yes
-
-$ zfs-tpm-list -b TPM2
-NAME      BACK-END  KEYSTATUS    COHERENT
-owo/venc  TPM2      unavailable  yes
-
-$ zfs-tpm-list -ra owo
-NAME      BACK-END  KEYSTATUS    COHERENT
-owo/venc  TPM2      unavailable  yes
-owo/vtnc  -         available    yes
-owo/v nc  -         available    yes
-owo/enc   TPM1.X    available    yes
-
-$ zfs-tpm-list -al
-NAME      BACK-END  KEYSTATUS  COHERENT
-awa       -         available  yes
-owo/vtnc  -         available  yes
-owo/v nc  -         available  yes
-owo/enc   TPM1.X    available  yes
-
- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- - - -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

-
diff --git a/zfs-tpm-list.md b/zfs-tpm-list.md deleted file mode 100644 index 0609833..0000000 --- a/zfs-tpm-list.md +++ /dev/null @@ -1,95 +0,0 @@ -zfs-tpm-list(8) -- print dataset tzpfms metadata -================================================ - -## SYNOPSIS - -`zfs-tpm-list` [-H] [-r\|-d *depth*] [-a\|-b *back-end*] [-u\|-l] [*filesystem*\|*volume*]… - -## DESCRIPTION - -zfs-tpm-list(8) lists the following properties on encryption roots: - - * `name`, - * `back-end`: the tzpfms back-end (e.g. "TPM2" for zfs-tpm2-change-key(8) or "TPM1.X" for zfs-tpm1x-change-key(8)), - or "-" if none is configured, - * `keystatus`: "available" or "unavailable", - * `coherent`: "yes" if either both `xyz.nabijaczleweli:tzpfms.backend` and `xyz.nabijaczleweli:tzpfms.key` are present or missing, "no" otherwise. - -Incoherent datasets require immediate operator attention, with either the appropriate zfs-tpm\*-clear-key program or zfs(8) change-key and zfs(8) inherit — -if the key becomes unloaded, they will require restoration from back-up. -However, they should never occur, unless something went terribly wrong with the dataset properties. - -If no datasets are specified, lists all matching encryption roots. -The default filter is to list all roots managed by tzpfms. -The `-a` and `-b` [OPTIONS]() can be used to either list all roots or only ones backed by a particular end, respectively. - -## OPTIONS - - * `-H`: - Used for scripting mode. Do not print headers and separate fields by a single tab instead of arbitrary white space. - - * `-r`: - Recurse into all descendant datasets. Default if no datasets listed on the command-line. - * `-d` *depth*: - Recurse at most *depth* datasets deep. Defaults to zero if datasets were listed on the command-line. - - * `-a`: - List all encryption roots, even ones not managed by tzpfms. - * `-b` *back-end*: - List only encryption roots with tzpfms back-end *back-end*. - - * `-l`: - List only encryption roots whose keys are available. - * `-u`: - List only encryption roots whose keys are unavailable. - -## EXAMPLES - - $ zfs-tpm-list - NAME BACK-END KEYSTATUS COHERENT - owo/venc TPM2 unavailable yes - owo/enc TPM1.X available yes - - $ zfs-tpm-list -ad0 - NAME BACK-END KEYSTATUS COHERENT - awa - available yes - - $ zfs-tpm-list -b TPM2 - NAME BACK-END KEYSTATUS COHERENT - owo/venc TPM2 unavailable yes - - $ zfs-tpm-list -ra owo - NAME BACK-END KEYSTATUS COHERENT - owo/venc TPM2 unavailable yes - owo/vtnc - available yes - owo/v nc - available yes - owo/enc TPM1.X available yes - - $ zfs-tpm-list -al - NAME BACK-END KEYSTATUS COHERENT - awa - available yes - owo/vtnc - available yes - owo/v nc - available yes - owo/enc TPM1.X available yes - - -## AUTHOR - -Written by наб <> - -## SPECIAL THANKS - -To all who support further development, in particular: - - * ThePhD - * Embark Studios - -## REPORTING BUGS - -<> - -<>, archived at <> - -## SEE ALSO - -<> diff --git a/zfs-tpm1x-change-key.8 b/zfs-tpm1x-change-key.8 index 690972f..ee728df 100644 --- a/zfs-tpm1x-change-key.8 +++ b/zfs-tpm1x-change-key.8 @@ -1,60 +1,150 @@ -.\" generated with Ronn-NG/v0.9.1 -.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 -.TH "ZFS\-TPM1X\-CHANGE\-KEY" "8" "January 2021" "tzpfms developers" -.SH "NAME" -\fBzfs\-tpm1x\-change\-key\fR \- change ZFS dataset key to one stored on the TPM -.SH "SYNOPSIS" -\fBzfs\-tpm1x\-change\-key\fR [\-b file] \fIdataset\fR -.SH "DESCRIPTION" -To normalise \fBdataset\fR, zfs\-tpm1x\-change\-key(8) will open its encryption root in its stead\. zfs\-tpm1x\-change\-key(8) will \fInever\fR create or destroy encryption roots; use \fBzfs(8) change\-key\fR for that\. -.P -First, a connection is made to the TPM, which \fImust\fR be TPM\-1\.X\-compatible\. -.P -If \fBdataset\fR was previously encrypted with tzpfms and the \fITPM1\.X\fR back\-end was used, the metadata will be silently cleared\. Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream\. -.P -Next, a new wrapping key is be generated on the TPM, optionally backed up (see \fIOPTIONS\fR), and sealed on the TPM; the user is prompted for an optional passphrase to protect the key with, and for the SRK passphrase, set when taking ownership, if it is not "well\-known" (all zeroes)\. -.P -The following properties are set on \fBdataset\fR: -.IP "\[ci]" 4 -\fBxyz\.nabijaczleweli:tzpfms\.backend\fR=\fBTPM1\.X\fR -.IP "\[ci]" 4 -\fBxyz\.nabijaczleweli:tzpfms\.key\fR=\fI(parent key blob)\fR\fB:\fR\fI(sealed object blob)\fR -.IP "" 0 -.P -\fBtzpfms\.backend\fR identifies this dataset for work with \fITPM1\.X\fR\-back\-ended tzpfms tools (namely zfs\-tpm1x\-change\-key(8), zfs\-tpm1x\-load\-key(8), and zfs\-tpm1x\-clear\-key(8))\. -.P -\fBtzpfms\.key\fR is a colon\-separated pair of hexadecimal\-string (i\.e\. "4F7730" for "Ow0") blobs; the first one represents the RSA key protecting the blob, and it is protected with either the password, if provided, or the SHA1 constant \fICE4CF677875B5EB8993591D5A9AF1ED24A3A8736\fR; the second represents the sealed object containing the wrapping key, and is protected with the SHA1 constant \fIB9EE715DBE4B243FAA81EA04306E063710383E35\fR\. There exists no other user\-land tool for decrypting this; perhaps there should be\. -.P -Finally, the equivalent of \fBzfs(8) change\-key \-o keylocation=prompt \-o keyformat=raw dataset\fR is performed with the new key\. If an error occurred, best effort is made to clean up the properties, or to issue a note for manual intervention into the standard error stream\. -.P -A final verification should be made by running \fBzfs\-tpm1x\-load\-key(8) \-n dataset\fR\. If that command succeeds, all is well, but otherwise the dataset can be manually rolled back to a password with \fBzfs\-tpm1x\-clear\-key(8) dataset\fR (or, if that fails to work, \fBzfs(8) change\-key \-o keyformat=passphrase dataset\fR), and you are hereby asked to report a bug, please\. -.P -\fBzfs\-tpm1x\-clear\-key(8) dataset\fR can be used to clear the properties and go back to using a password\. -.SH "OPTIONS" -.TP -\fB\-b\fR \fIfile\fR -Save a back\-up of the key to \fIfile\fR, which must not exist beforehand\. This back\-up \fBmust\fR be stored securely, off\-site\. In case of a catastrophic event, the key can be loaded by running \fBzfs(8) load\-key dataset < backup\-file\fR\. -.SH "TPM1\.X back\-end configuration" -.SS "TPM selection" -The tzpfms suite connects to a local tcsd(8) process (at \fBlocalhost:30003\fR) by default\. Use the environment variable \fBTZPFMS_TPM1X\fR to specify a remote TCS hostname\. -.P -The TrouSerS tcsd(8) daemon will try \fB/dev/tpm0\fR, then \fB/udev/tpm0\fR, then \fB/dev/tpm\fR; by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected\. -.SS "See also" -The TrouSerS project page at \fIhttps://sourceforge\.net/projects/trousers\fR\. -.P -The TPM 1\.2 main specification index at <\fIhttps://trustedcomputinggroup\.org/resource/tpm\-main\-specification\fR>\. -.SH "AUTHOR" -Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR> -.SH "SPECIAL THANKS" +.Dd October 15, 2021 +.ds doc-volume-operating-system +.Dt ZFS-TPM1X-CHANGE-KEY 8 +.Os tzpfms 0.1-5 +. +.Sh NAME +.Nm zfs-tpm1x-change-key +.Nd change ZFS dataset key to one stored on the TPM +.Sh SYNOPSIS +.Nm +.Op Fl b Ar backup-file +.Ar dataset +. +.Sh DESCRIPTION +To normalise the +.Ar dataset , +.Nm +will open its encryption root in its stead. +.Nm +will +.Em never +create or destroy encryption roots; use +.Xr zfs-change-key 8 +for that. +.Pp +First, a connection is made to the TPM, which +.Em must +be TPM-1.X-compatible. +.Pp +If +.Ar dataset +was previously encrypted with +.Nm tzpfms +and the +.Sy TPM1.X +back-end was used, the metadata will be silently cleared. +Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream. +.Pp +Next, a new wrapping key is be generated on the TPM, optionally backed up +.Pq see Sx OPTIONS , +and sealed on the TPM; +the user is prompted for an optional passphrase to protect the key with, +and for the SRK passphrase, set when taking ownership, if it is not "well-known" (all zeroes). +.Pp +The following properties are set on +.Ar dataset : +.Bl -bullet -compact -offset 4n -width "" +.\"" TODO: width? +.It +.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy TPM1.X +.It +.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar parent-key-blob Ns Cm \&: Ns Ar sealed-object-blob +.El +.Pp +.Li tzpfms.backend +identifies this dataset for work with +.Sy TPM1.X Ns -back-ended +.Nm tzpfms +tools +.Pq namely Xr zfs-tpm1x-change-key 8 , Xr zfs-tpm1x-load-key 8 , and Xr zfs-tpm1x-clear-key 8 . +.Pp +.Li tzpfms.key +is a colon-separated pair of hexadecimal-string (i.e. "4F7730" for "Ow0") blobs; +the first one represents the RSA key protecting the blob, +and it is protected with either the password, if provided, or the SHA1 constant +.Li CE4CF677875B5EB8993591D5A9AF1ED24A3A8736 ; +the second represents the sealed object containing the wrapping key, +and is protected with the SHA1 constant +.Li B9EE715DBE4B243FAA81EA04306E063710383E35 . +There exists no other user-land tool for decrypting this; perhaps there should be. +.\"" TODO: make an LD_PRELOADable for extracting the key maybe? +.Pp +Finally, the equivalent of +.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset +is performed with the new key. +If an error occurred, best effort is made to clean up the properties, +or to issue a note for manual intervention into the standard error stream. +.Pp +A final verification should be made by running +.Nm zfs-tpm1x-load-key Fl n Ar dataset . +If that command succeeds, all is well, +but otherwise the dataset can be manually rolled back to a password with +.Nm zfs-tpm1x-clear-key Ar dataset +.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , +and you are hereby asked to report a bug, please. +.Pp +.Nm zfs-tpm1x-clear-key Ar dataset +can be used to clear the properties and go back to using a password. +. +.Sh OPTIONS +.Bl -tag -compact -width "-b backup-file" +.It Fl b Ar backup-file +Save a back-up of the key to +.Ar backup-file , +which must not exist beforehand. +This back-up +.Em must +be stored securely, off-site. +In case of a catastrophic event, the key can be loaded by running +.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file +.El +. +.Sh TPM1.X back-end configuration +.Ss TPM selection +The +.Nm tzpfms +suite connects to a local +.Xr tcsd 8 +process +.Pq at Pa localhost:30003 +by default. +Use the environment variable +.Ev TZPFMS_TPM1X +to specify a remote TCS hostname. +.Pp +The TrouSerS +.Xr tcsd 8 +daemon will try +.Pa /dev/tpm0 , +then +.Pa /udev/tpm0 , +then +.Pa /dev/tpm ; +by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected. +. +.Ss See also +The TrouSerS project page at +.Lk https:/\&/sourceforge.net/projects/trousers . +.Pp +The TPM 1.2 main specification index at +.Lk https:/\&/trustedcomputinggroup.org/resource/tpm-main-specification . +. +.Sh SPECIAL THANKS To all who support further development, in particular: -.IP "\[ci]" 4 +.Bl -bullet -offset 4n -compact -width 0 +.It ThePhD -.IP "\[ci]" 4 +.It Embark Studios -.IP "" 0 -.SH "REPORTING BUGS" -<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.P -<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.SH "SEE ALSO" -<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR> +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/~nabijaczleweli/tzpfms +.Pp +.Mt ~nabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/~nabijaczleweli/tzpfms . +. +.Sh SEE ALSO +.Lk https:/\&/git.sr.ht/~nabijaczleweli/tzpfms diff --git a/zfs-tpm1x-change-key.8.html b/zfs-tpm1x-change-key.8.html index 35996c8..8aef343 100644 --- a/zfs-tpm1x-change-key.8.html +++ b/zfs-tpm1x-change-key.8.html @@ -1,187 +1,170 @@ - - - zfs-tpm1x-change-key(8) - change ZFS dataset key to one stored on the TPM - + + + + ZFS-TPM1X-CHANGE-KEY(8) - - -
- - - -
    -
  1. zfs-tpm1x-change-key(8)
    2. -
  2. -
  3. zfs-tpm1x-change-key(8)
    4. -
- - - -

NAME

-

- zfs-tpm1x-change-key - change ZFS dataset key to one stored on the TPM -

-

SYNOPSIS

- -

zfs-tpm1x-change-key [-b file] dataset

- -

DESCRIPTION

- -

To normalise dataset, zfs-tpm1x-change-key(8) will open its encryption root in its stead. -zfs-tpm1x-change-key(8) will never create or destroy encryption roots; use zfs(8) change-key for that.

- -

First, a connection is made to the TPM, which must be TPM-1.X-compatible.

- -

If dataset was previously encrypted with tzpfms and the TPM1.X back-end was used, the metadata will be silently cleared. -Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream.

- -

Next, a new wrapping key is be generated on the TPM, optionally backed up (see OPTIONS), -and sealed on the TPM; -the user is prompted for an optional passphrase to protect the key with, -and for the SRK passphrase, set when taking ownership, if it is not "well-known" (all zeroes).

- -

The following properties are set on dataset:

- -
    -
  • -xyz.nabijaczleweli:tzpfms.backend=TPM1.X -
    • -
  • -xyz.nabijaczleweli:tzpfms.key=(parent key blob):(sealed object blob) -
    • + + + + + + + +
    ZFS-TPM1X-CHANGE-KEY(8)System Manager's ManualZFS-TPM1X-CHANGE-KEY(8)
    +
    +
    +

    +

    zfs-tpm1x-change-key — + change ZFS dataset key to one stored on the TPM

    +
    +
    +

    + + + + + +
    zfs-tpm1x-change-key[-b backup-file] + dataset
    +
    +
    +

    +

    To normalise the dataset, + zfs-tpm1x-change-key will open its encryption root + in its stead. zfs-tpm1x-change-key will + + create or destroy encryption roots; use + zfs-change-key(8) + for that.

    +

    First, a connection is made to the TPM, which + must be TPM-1.X-compatible.

    +

    If dataset was previously encrypted with + tzpfms and the TPM1.X back-end was + used, the metadata will be silently cleared. Otherwise, or in case of an + error, data required for manual intervention will be printed to the standard + error stream.

    +

    Next, a new wrapping key is be generated on the TPM, optionally + backed up (see OPTIONS), and sealed on the + TPM; the user is prompted for an optional passphrase to protect the key + with, and for the SRK passphrase, set when taking ownership, if it is not + "well-known" (all zeroes).

    +

    The following properties are set on + dataset:

    + - -

    tzpfms.backend identifies this dataset for work with TPM1.X-back-ended tzpfms tools -(namely zfs-tpm1x-change-key(8), zfs-tpm1x-load-key(8), and zfs-tpm1x-clear-key(8)).

    - -

    tzpfms.key is a colon-separated pair of hexadecimal-string (i.e. "4F7730" for "Ow0") blobs; -the first one represents the RSA key protecting the blob, -and it is protected with either the password, if provided, or the SHA1 constant CE4CF677875B5EB8993591D5A9AF1ED24A3A8736; -the second represents the sealed object containing the wrapping key, -and is protected with the SHA1 constant B9EE715DBE4B243FAA81EA04306E063710383E35. -There exists no other user-land tool for decrypting this; perhaps there should be.

    - -

    Finally, the equivalent of zfs(8) change-key -o keylocation=prompt -o keyformat=raw dataset is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream.

    - -

    A final verification should be made by running zfs-tpm1x-load-key(8) -n dataset. -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a password with zfs-tpm1x-clear-key(8) dataset (or, if that fails to work, zfs(8) change-key -o keyformat=passphrase dataset), and you are hereby asked to report a bug, please.

    - -

    zfs-tpm1x-clear-key(8) dataset can be used to clear the properties and go back to using a password.

    - -

    OPTIONS

    - -
    -
    --b file -
    -
    Save a back-up of the key to file, which must not exist beforehand. -This back-up must be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running zfs(8) load-key dataset < backup-file.
    +

    tzpfms.backend identifies this dataset for + work with TPM1.X-back-ended tzpfms + tools (namely + zfs-tpm1x-change-key(8), + zfs-tpm1x-load-key(8), + and + zfs-tpm1x-clear-key(8)).

    +

    tzpfms.key is a colon-separated pair of + hexadecimal-string (i.e. "4F7730" for "Ow0") blobs; the + first one represents the RSA key protecting the blob, and it is protected + with either the password, if provided, or the SHA1 constant + CE4CF677875B5EB8993591D5A9AF1ED24A3A8736; the second + represents the sealed object containing the wrapping key, and is protected + with the SHA1 constant + B9EE715DBE4B243FAA81EA04306E063710383E35. There + exists no other user-land tool for decrypting this; perhaps there should + be.

    +

    Finally, the equivalent of zfs + change-key -o + keylocation=prompt -o + keyformat=raw dataset is + performed with the new key. If an error occurred, best effort is made to + clean up the properties, or to issue a note for manual intervention into the + standard error stream.

    +

    A final verification should be made by running + zfs-tpm1x-load-key -n + dataset. If that command succeeds, all is well, but + otherwise the dataset can be manually rolled back to a password with + zfs-tpm1x-clear-key dataset + (or, if that fails to work, zfs + change-key -o + keyformat=passphrase dataset), + and you are hereby asked to report a bug, please.

    +

    zfs-tpm1x-clear-key + dataset can be used to clear the properties and go + back to using a password.

    +
    +
    +

    +
    +
    + backup-file
    +
    Save a back-up of the key to backup-file, which must + not exist beforehand. This back-up must be stored + securely, off-site. In case of a catastrophic event, the key can be loaded + by running +
    zfs + load-key dataset + < + backup-file
    +
    - -

    TPM1.X back-end configuration

    - -

    TPM selection

    - -

    The tzpfms suite connects to a local tcsd(8) process (at localhost:30003) by default. -Use the environment variable TZPFMS_TPM1X to specify a remote TCS hostname.

    - -

    The TrouSerS tcsd(8) daemon will try /dev/tpm0, then /udev/tpm0, then /dev/tpm; -by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected.

    - -

    See also

    - -

    The TrouSerS project page at https://sourceforge.net/projects/trousers.

    - -

    The TPM 1.2 main specification index at <https://trustedcomputinggroup.org/resource/tpm-main-specification>.

    - -

    AUTHOR

    - -

    Written by наб <nabijaczleweli@nabijaczleweli.xyz>

    - -

    SPECIAL THANKS

    - -

    To all who support further development, in particular:

    - -
      +
    +
    +

    +
    +

    +

    The tzpfms suite connects to a local + tcsd(8) + process (at localhost:30003) by default. Use the + environment variable TZPFMS_TPM1X to specify a + remote TCS hostname.

    +

    The TrouSerS + tcsd(8) + daemon will try /dev/tpm0, then + /udev/tpm0, then /dev/tpm; + by occupying one of the earlier ones with, for example, shell redirection, a + later one can be selected.

    +
    +
    +

    +

    The TrouSerS project page at + https://sourceforge.net/projects/trousers.

    +

    The TPM 1.2 main specification index at + https://trustedcomputinggroup.org/resource/tpm-main-specification.

    +
    +
    +
    +

    +

    To all who support further development, in particular:

    +
    • ThePhD
    • Embark Studios
    - -

    REPORTING BUGS

    - -

    <https://todo.sr.ht/~nabijaczleweli/tzpfms>

    - -

    <~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

    - -

    SEE ALSO

    - -

    <https://git.sr.ht/~nabijaczleweli/tzpfms>

    - -
      -
    1. tzpfms developers
      2. -
    2. January 2021
      3. -
    3. zfs-tpm1x-change-key(8)
      4. -
    - -
    + +
    +

    +

    https://todo.sr.ht/~nabijaczleweli/tzpfms

    +

    ~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

    +
    +
    +

    +

    https://git.sr.ht/~nabijaczleweli/tzpfms

    +
    +
+ + + + + +
October 15, 2021tzpfms 0.1-5
diff --git a/zfs-tpm1x-change-key.8.html_fragment b/zfs-tpm1x-change-key.8.html_fragment deleted file mode 100644 index 46dd327..0000000 --- a/zfs-tpm1x-change-key.8.html_fragment +++ /dev/null @@ -1,106 +0,0 @@ -
- -

NAME

-

- zfs-tpm1x-change-key - change ZFS dataset key to one stored on the TPM -

-

SYNOPSIS

- -

zfs-tpm1x-change-key [-b file] dataset

- -

DESCRIPTION

- -

To normalise dataset, zfs-tpm1x-change-key(8) will open its encryption root in its stead. -zfs-tpm1x-change-key(8) will never create or destroy encryption roots; use zfs(8) change-key for that.

- -

First, a connection is made to the TPM, which must be TPM-1.X-compatible.

- -

If dataset was previously encrypted with tzpfms and the TPM1.X back-end was used, the metadata will be silently cleared. -Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream.

- -

Next, a new wrapping key is be generated on the TPM, optionally backed up (see OPTIONS), -and sealed on the TPM; -the user is prompted for an optional passphrase to protect the key with, -and for the SRK passphrase, set when taking ownership, if it is not "well-known" (all zeroes).

- -

The following properties are set on dataset:

- -
    -
  • -xyz.nabijaczleweli:tzpfms.backend=TPM1.X -
    • -
  • -xyz.nabijaczleweli:tzpfms.key=(parent key blob):(sealed object blob) -
    • -
- -

tzpfms.backend identifies this dataset for work with TPM1.X-back-ended tzpfms tools -(namely zfs-tpm1x-change-key(8), zfs-tpm1x-load-key(8), and zfs-tpm1x-clear-key(8)).

- -

tzpfms.key is a colon-separated pair of hexadecimal-string (i.e. "4F7730" for "Ow0") blobs; -the first one represents the RSA key protecting the blob, -and it is protected with either the password, if provided, or the SHA1 constant CE4CF677875B5EB8993591D5A9AF1ED24A3A8736; -the second represents the sealed object containing the wrapping key, -and is protected with the SHA1 constant B9EE715DBE4B243FAA81EA04306E063710383E35. -There exists no other user-land tool for decrypting this; perhaps there should be.

- -

Finally, the equivalent of zfs(8) change-key -o keylocation=prompt -o keyformat=raw dataset is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream.

- -

A final verification should be made by running zfs-tpm1x-load-key(8) -n dataset. -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a password with zfs-tpm1x-clear-key(8) dataset (or, if that fails to work, zfs(8) change-key -o keyformat=passphrase dataset), and you are hereby asked to report a bug, please.

- -

zfs-tpm1x-clear-key(8) dataset can be used to clear the properties and go back to using a password.

- -

OPTIONS

- -
-
--b file -
-
Save a back-up of the key to file, which must not exist beforehand. -This back-up must be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running zfs(8) load-key dataset < backup-file.
-
- -

TPM1.X back-end configuration

- -

TPM selection

- -

The tzpfms suite connects to a local tcsd(8) process (at localhost:30003) by default. -Use the environment variable TZPFMS_TPM1X to specify a remote TCS hostname.

- -

The TrouSerS tcsd(8) daemon will try /dev/tpm0, then /udev/tpm0, then /dev/tpm; -by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected.

- -

See also

- -

The TrouSerS project page at https://sourceforge.net/projects/trousers.

- -

The TPM 1.2 main specification index at <https://trustedcomputinggroup.org/resource/tpm-main-specification>.

- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- -
    -
  • ThePhD
    • -
  • Embark Studios
    • -
- -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

-
diff --git a/zfs-tpm1x-change-key.md b/zfs-tpm1x-change-key.md deleted file mode 100644 index 36815ff..0000000 --- a/zfs-tpm1x-change-key.md +++ /dev/null @@ -1,90 +0,0 @@ -zfs-tpm1x-change-key(8) -- change ZFS dataset key to one stored on the TPM -========================================================================== - -## SYNOPSIS - -`zfs-tpm1x-change-key` [-b file] - -## DESCRIPTION - -To normalise `dataset`, zfs-tpm1x-change-key(8) will open its encryption root in its stead. -zfs-tpm1x-change-key(8) will *never* create or destroy encryption roots; use **zfs(8) change-key** for that. - -First, a connection is made to the TPM, which *must* be TPM-1.X-compatible. - -If `dataset` was previously encrypted with tzpfms and the *TPM1.X* back-end was used, the metadata will be silently cleared. -Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream. - -Next, a new wrapping key is be generated on the TPM, optionally backed up (see [OPTIONS][]), -and sealed on the TPM; -the user is prompted for an optional passphrase to protect the key with, -and for the SRK passphrase, set when taking ownership, if it is not "well-known" (all zeroes). - -The following properties are set on `dataset`: - - * `xyz.nabijaczleweli:tzpfms.backend`=`TPM1.X` - * `xyz.nabijaczleweli:tzpfms.key`=*(parent key blob)*`:`*(sealed object blob)* - -`tzpfms.backend` identifies this dataset for work with *TPM1.X*-back-ended tzpfms tools -(namely zfs-tpm1x-change-key(8), zfs-tpm1x-load-key(8), and zfs-tpm1x-clear-key(8)). - -`tzpfms.key` is a colon-separated pair of hexadecimal-string (i.e. "4F7730" for "Ow0") blobs; -the first one represents the RSA key protecting the blob, -and it is protected with either the password, if provided, or the SHA1 constant *CE4CF677875B5EB8993591D5A9AF1ED24A3A8736*; -the second represents the sealed object containing the wrapping key, -and is protected with the SHA1 constant *B9EE715DBE4B243FAA81EA04306E063710383E35*. -There exists no other user-land tool for decrypting this; perhaps there should be. - -Finally, the equivalent of **zfs(8) change-key -o keylocation=prompt -o keyformat=raw dataset** is performed with the new key. -If an error occurred, best effort is made to clean up the properties, -or to issue a note for manual intervention into the standard error stream. - -A final verification should be made by running **zfs-tpm1x-load-key(8) -n dataset**. -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a password with **zfs-tpm1x-clear-key(8) dataset** (or, if that fails to work, **zfs(8) change-key -o keyformat=passphrase dataset**), and you are hereby asked to report a bug, please. - -**zfs-tpm1x-clear-key(8) dataset** can be used to clear the properties and go back to using a password. - -## OPTIONS - - * `-b` *file*: - Save a back-up of the key to *file*, which must not exist beforehand. - This back-up **must** be stored securely, off-site. - In case of a catastrophic event, the key can be loaded by running **zfs(8) load-key dataset < backup-file**. - -## TPM1.X back-end configuration - -### TPM selection - -The tzpfms suite connects to a local tcsd(8) process (at `localhost:30003`) by default. -Use the environment variable `TZPFMS_TPM1X` to specify a remote TCS hostname. - -The TrouSerS tcsd(8) daemon will try `/dev/tpm0`, then `/udev/tpm0`, then `/dev/tpm`; -by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected. - -### See also - -The TrouSerS project page at . - -The TPM 1.2 main specification index at <>. - -## AUTHOR - -Written by наб <> - -## SPECIAL THANKS - -To all who support further development, in particular: - - * ThePhD - * Embark Studios - -## REPORTING BUGS - -<> - -<>, archived at <> - -## SEE ALSO - -<> diff --git a/zfs-tpm1x-clear-key.8 b/zfs-tpm1x-clear-key.8 index 5ad848e..e5b985e 100644 --- a/zfs-tpm1x-clear-key.8 +++ b/zfs-tpm1x-clear-key.8 @@ -1,40 +1,82 @@ -.\" generated with Ronn-NG/v0.9.1 -.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 -.TH "ZFS\-TPM1X\-CLEAR\-KEY" "8" "January 2021" "tzpfms developers" -.SH "NAME" -\fBzfs\-tpm1x\-clear\-key\fR \- rewrap ZFS dataset key in passsword and clear tzpfms TPM1\.X metadata -.SH "SYNOPSIS" -\fBzfs\-tpm1x\-clear\-key\fR \fIdataset\fR -.SH "DESCRIPTION" -zfs\-tpm1x\-clear\-key(8), after verifying that \fBdataset\fR was encrypted with tzpfms backend \fITPM1\.X\fR will: -.IP "1." 4 -perform the equivalent of \fBzfs(8) change\-key \-o keylocation=prompt \-o keyformat=passphrase dataset\fR, -.IP "2." 4 -remove the \fBxyz\.nabijaczleweli:tzpfms\.{backend,key}\fR properties from \fBdataset\fR\. -.IP "" 0 -.P -See zfs\-tpm1x\-change\-key(8) for a detailed description\. -.SH "TPM1\.X back\-end configuration" -.SS "TPM selection" -The tzpfms suite connects to a local tcsd(8) process (at \fBlocalhost:30003\fR) by default\. Use the environment variable \fBTZPFMS_TPM1X\fR to specify a remote TCS hostname\. -.P -The TrouSerS tcsd(8) daemon will try \fB/dev/tpm0\fR, then \fB/udev/tpm0\fR, then \fB/dev/tpm\fR; by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected\. -.SS "See also" -The TrouSerS project page at \fIhttps://sourceforge\.net/projects/trousers\fR\. -.P -The TPM 1\.2 main specification index at <\fIhttps://trustedcomputinggroup\.org/resource/tpm\-main\-specification\fR>\. -.SH "AUTHOR" -Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR> -.SH "SPECIAL THANKS" +.Dd October 15, 2021 +.ds doc-volume-operating-system +.Dt ZFS-TPM1X-CLEAR-KEY 8 +.Os tzpfms 0.1-5 +. +.Sh NAME +.Nm zfs-tpm1x-clear-key +.Nd rewrap ZFS dataset key in passsword and clear tzpfms TPM1.X metadata +.Sh SYNOPSIS +.Nm +.Ar dataset +. +.Sh DESCRIPTION +After verifying +.Ar dataset +was encrypted with +.Nm tzpfms +backend +.Sy TPM1.X : +.Bl -enum -compact -offset 4n -width "" +.It +performs the equivalent of +.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , +.It +removes the +.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key +properties from +.Ar dataset . +.El +.Pp +See +.Xr zfs-tpm1x-change-key 8 +for a detailed description. +. +.Sh TPM1.X back-end configuration +.Ss TPM selection +The +.Nm tzpfms +suite connects to a local +.Xr tcsd 8 +process +.Pq at Pa localhost:30003 +by default. +Use the environment variable +.Ev TZPFMS_TPM1X +to specify a remote TCS hostname. +.Pp +The TrouSerS +.Xr tcsd 8 +daemon will try +.Pa /dev/tpm0 , +then +.Pa /udev/tpm0 , +then +.Pa /dev/tpm ; +by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected. +. +.Ss See also +The TrouSerS project page at +.Lk https:/\&/sourceforge.net/projects/trousers . +.Pp +The TPM 1.2 main specification index at +.Lk https:/\&/trustedcomputinggroup.org/resource/tpm-main-specification . +. +.Sh SPECIAL THANKS To all who support further development, in particular: -.IP "\[ci]" 4 +.Bl -bullet -offset 4n -compact -width 0 +.It ThePhD -.IP "\[ci]" 4 +.It Embark Studios -.IP "" 0 -.SH "REPORTING BUGS" -<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.P -<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.SH "SEE ALSO" -<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR> +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/~nabijaczleweli/tzpfms +.Pp +.Mt ~nabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/~nabijaczleweli/tzpfms . +. +.Sh SEE ALSO +.Lk https:/\&/git.sr.ht/~nabijaczleweli/tzpfms diff --git a/zfs-tpm1x-clear-key.8.html b/zfs-tpm1x-clear-key.8.html index e755907..7b6c534 100644 --- a/zfs-tpm1x-clear-key.8.html +++ b/zfs-tpm1x-clear-key.8.html @@ -1,140 +1,110 @@ - - - zfs-tpm1x-clear-key(8) - rewrap ZFS dataset key in passsword and clear tzpfms TPM1.X metadata - + + + + ZFS-TPM1X-CLEAR-KEY(8) - - -
- - - -
    -
  1. zfs-tpm1x-clear-key(8)
    2. -
  2. -
  3. zfs-tpm1x-clear-key(8)
    4. -
- - - -

NAME

-

- zfs-tpm1x-clear-key - rewrap ZFS dataset key in passsword and clear tzpfms TPM1.X metadata -

-

SYNOPSIS

- -

zfs-tpm1x-clear-key dataset

- -

DESCRIPTION

- -

zfs-tpm1x-clear-key(8), after verifying that dataset was encrypted with tzpfms backend TPM1.X will:

- -
    -
  1. perform the equivalent of zfs(8) change-key -o keylocation=prompt -o keyformat=passphrase dataset,
    2. -
  2. remove the xyz.nabijaczleweli:tzpfms.{backend,key} properties from dataset.
    3. + + + + + + + +
    ZFS-TPM1X-CLEAR-KEY(8)System Manager's ManualZFS-TPM1X-CLEAR-KEY(8)
    +
    +
    +

    +

    zfs-tpm1x-clear-key — + rewrap ZFS dataset key in passsword and clear tzpfms TPM1.X + metadata

    +
    +
    +

    + + + + + +
    zfs-tpm1x-clear-keydataset
    +
    +
    +

    +

    After verifying dataset was encrypted with + tzpfms backend + :

    +
      +
    1. performs the equivalent of zfs + change-key -o + keylocation=prompt -o + keyformat=passphrase + dataset,
      2. +
    2. removes the + xyz.nabijaczleweli:tzpfms.{backend, + key} properties from + dataset.
    - -

    See zfs-tpm1x-change-key(8) for a detailed description.

    - -

    TPM1.X back-end configuration

    - -

    TPM selection

    - -

    The tzpfms suite connects to a local tcsd(8) process (at localhost:30003) by default. -Use the environment variable TZPFMS_TPM1X to specify a remote TCS hostname.

    - -

    The TrouSerS tcsd(8) daemon will try /dev/tpm0, then /udev/tpm0, then /dev/tpm; -by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected.

    - -

    See also

    - -

    The TrouSerS project page at https://sourceforge.net/projects/trousers.

    - -

    The TPM 1.2 main specification index at <https://trustedcomputinggroup.org/resource/tpm-main-specification>.

    - -

    AUTHOR

    - -

    Written by наб <nabijaczleweli@nabijaczleweli.xyz>

    - -

    SPECIAL THANKS

    - -

    To all who support further development, in particular:

    - -
    +
    +

    +
    +

    +

    The tzpfms suite connects to a local + tcsd(8) + process (at localhost:30003) by default. Use the + environment variable TZPFMS_TPM1X to specify a + remote TCS hostname.

    +

    The TrouSerS + tcsd(8) + daemon will try /dev/tpm0, then + /udev/tpm0, then /dev/tpm; + by occupying one of the earlier ones with, for example, shell redirection, a + later one can be selected.

    +
    +
    +

    +

    The TrouSerS project page at + https://sourceforge.net/projects/trousers.

    +

    The TPM 1.2 main specification index at + https://trustedcomputinggroup.org/resource/tpm-main-specification.

    +
    +
    +
    +

    +

    To all who support further development, in particular:

    +
    • ThePhD
    • Embark Studios
    - -

    REPORTING BUGS

    - -

    <https://todo.sr.ht/~nabijaczleweli/tzpfms>

    - -

    <~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

    - -

    SEE ALSO

    - -

    <https://git.sr.ht/~nabijaczleweli/tzpfms>

    - -
      -
    1. tzpfms developers
      2. -
    2. January 2021
      3. -
    3. zfs-tpm1x-clear-key(8)
      4. -
    - -
    + +
    +

    +

    https://todo.sr.ht/~nabijaczleweli/tzpfms

    +

    ~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

    +
    +
    +

    +

    https://git.sr.ht/~nabijaczleweli/tzpfms

    +
    +
+ + + + + +
October 15, 2021tzpfms 0.1-5
diff --git a/zfs-tpm1x-clear-key.8.html_fragment b/zfs-tpm1x-clear-key.8.html_fragment deleted file mode 100644 index 1d48f1c..0000000 --- a/zfs-tpm1x-clear-key.8.html_fragment +++ /dev/null @@ -1,60 +0,0 @@ -
- -

NAME

-

- zfs-tpm1x-clear-key - rewrap ZFS dataset key in passsword and clear tzpfms TPM1.X metadata -

-

SYNOPSIS

- -

zfs-tpm1x-clear-key dataset

- -

DESCRIPTION

- -

zfs-tpm1x-clear-key(8), after verifying that dataset was encrypted with tzpfms backend TPM1.X will:

- -
    -
  1. perform the equivalent of zfs(8) change-key -o keylocation=prompt -o keyformat=passphrase dataset,
    2. -
  2. remove the xyz.nabijaczleweli:tzpfms.{backend,key} properties from dataset.
    3. -
- -

See zfs-tpm1x-change-key(8) for a detailed description.

- -

TPM1.X back-end configuration

- -

TPM selection

- -

The tzpfms suite connects to a local tcsd(8) process (at localhost:30003) by default. -Use the environment variable TZPFMS_TPM1X to specify a remote TCS hostname.

- -

The TrouSerS tcsd(8) daemon will try /dev/tpm0, then /udev/tpm0, then /dev/tpm; -by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected.

- -

See also

- -

The TrouSerS project page at https://sourceforge.net/projects/trousers.

- -

The TPM 1.2 main specification index at <https://trustedcomputinggroup.org/resource/tpm-main-specification>.

- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- -
    -
  • ThePhD
    • -
  • Embark Studios
    • -
- -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

-
diff --git a/zfs-tpm1x-clear-key.md b/zfs-tpm1x-clear-key.md deleted file mode 100644 index 9e9f932..0000000 --- a/zfs-tpm1x-clear-key.md +++ /dev/null @@ -1,52 +0,0 @@ -zfs-tpm1x-clear-key(8) -- rewrap ZFS dataset key in passsword and clear tzpfms TPM1.X metadata -============================================================================================== - -## SYNOPSIS - -`zfs-tpm1x-clear-key` - -## DESCRIPTION - -zfs-tpm1x-clear-key(8), after verifying that `dataset` was encrypted with tzpfms backend *TPM1.X* will: - - 1. perform the equivalent of **zfs(8) change-key -o keylocation=prompt -o keyformat=passphrase dataset**, - 2. remove the `xyz.nabijaczleweli:tzpfms.{backend,key}` properties from `dataset`. - -See zfs-tpm1x-change-key(8) for a detailed description. - -## TPM1.X back-end configuration - -### TPM selection - -The tzpfms suite connects to a local tcsd(8) process (at `localhost:30003`) by default. -Use the environment variable `TZPFMS_TPM1X` to specify a remote TCS hostname. - -The TrouSerS tcsd(8) daemon will try `/dev/tpm0`, then `/udev/tpm0`, then `/dev/tpm`; -by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected. - -### See also - -The TrouSerS project page at . - -The TPM 1.2 main specification index at <>. - -## AUTHOR - -Written by наб <> - -## SPECIAL THANKS - -To all who support further development, in particular: - - * ThePhD - * Embark Studios - -## REPORTING BUGS - -<> - -<>, archived at <> - -## SEE ALSO - -<> diff --git a/zfs-tpm1x-load-key.8 b/zfs-tpm1x-load-key.8 index ca3079b..3c99490 100644 --- a/zfs-tpm1x-load-key.8 +++ b/zfs-tpm1x-load-key.8 @@ -1,41 +1,88 @@ -.\" generated with Ronn-NG/v0.9.1 -.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 -.TH "ZFS\-TPM1X\-LOAD\-KEY" "8" "January 2021" "tzpfms developers" -.SH "NAME" -\fBzfs\-tpm1x\-load\-key\fR \- load tzpfms TPM1\.X\-encrypted ZFS dataset key -.SH "SYNOPSIS" -\fBzfs\-tpm1x\-load\-key\fR [\-n] \fIdataset\fR -.SH "DESCRIPTION" -zfs\-tpm1x\-load\-key(8), after verifying that \fBdataset\fR was encrypted with tzpfms backend \fITPM1\.X\fR will unseal the key and load it into \fBdataset\fR\. -.P -The user is prompted for, first, the SRK passphrase, set when taking ownership, if it\'s not "well\-known" (all zeroes), then the additional passphrase set when creating the key, if it was provided\. -.P -See zfs\-tpm1x\-change\-key(8) for a detailed description\. -.SH "OPTIONS" -.TP -\fB\-n\fR -Do a no\-op/dry run, can be used even if the key is already loaded\. Equivalent to \fBzfs(8) load\-key\fR\'s \fB\-n\fR option\. -.SH "TPM1\.X back\-end configuration" -.SS "TPM selection" -The tzpfms suite connects to a local tcsd(8) process (at \fBlocalhost:30003\fR) by default\. Use the environment variable \fBTZPFMS_TPM1X\fR to specify a remote TCS hostname\. -.P -The TrouSerS tcsd(8) daemon will try \fB/dev/tpm0\fR, then \fB/udev/tpm0\fR, then \fB/dev/tpm\fR; by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected\. -.SS "See also" -The TrouSerS project page at \fIhttps://sourceforge\.net/projects/trousers\fR\. -.P -The TPM 1\.2 main specification index at <\fIhttps://trustedcomputinggroup\.org/resource/tpm\-main\-specification\fR>\. -.SH "AUTHOR" -Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR> -.SH "SPECIAL THANKS" +.Dd October 15, 2021 +.ds doc-volume-operating-system +.Dt ZFS-TPM1X-LOAD-KEY 8 +.Os tzpfms 0.1-5 +. +.Sh NAME +.Nm zfs-tpm1x-load-key +.Nd load tzpfms TPM1.X-encrypted ZFS dataset key +.Sh SYNOPSIS +.Nm +.Op Fl n +.Ar dataset +. +.Sh DESCRIPTION +After verifying +.Ar dataset +was encrypted with +.Nm tzpfms +backend +.Sy TPM1.X +will unseal the key and load it into +.Ar dataset . +.Pp +The user is prompted for, first, the SRK passphrase, set when taking ownership, if it's not "well-known" (all zeroes), +then the additional passphrase set when creating the key, if it was provided. +.Pp +See +.Xr zfs-tpm1x-change-key 8 +for a detailed description. +. +.Sh OPTIONS +.Bl -tag -compact -width "-n" +.It Fl n +Do a no-op/dry run, can be used even if the key is already loaded. +Equivalent to +.Nm zfs Cm load-key Ns 's +.Fl n +option. +.El +. +.Sh TPM1.X back-end configuration +.Ss TPM selection +The +.Nm tzpfms +suite connects to a local +.Xr tcsd 8 +process +.Pq at Pa localhost:30003 +by default. +Use the environment variable +.Ev TZPFMS_TPM1X +to specify a remote TCS hostname. +.Pp +The TrouSerS +.Xr tcsd 8 +daemon will try +.Pa /dev/tpm0 , +then +.Pa /udev/tpm0 , +then +.Pa /dev/tpm ; +by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected. +. +.Ss See also +The TrouSerS project page at +.Lk https:/\&/sourceforge.net/projects/trousers . +.Pp +The TPM 1.2 main specification index at +.Lk https:/\&/trustedcomputinggroup.org/resource/tpm-main-specification . +. +.Sh SPECIAL THANKS To all who support further development, in particular: -.IP "\[ci]" 4 +.Bl -bullet -offset 4n -compact -width 0 +.It ThePhD -.IP "\[ci]" 4 +.It Embark Studios -.IP "" 0 -.SH "REPORTING BUGS" -<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.P -<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.SH "SEE ALSO" -<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR> +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/~nabijaczleweli/tzpfms +.Pp +.Mt ~nabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/~nabijaczleweli/tzpfms . +. +.Sh SEE ALSO +.Lk https:/\&/git.sr.ht/~nabijaczleweli/tzpfms diff --git a/zfs-tpm1x-load-key.8.html b/zfs-tpm1x-load-key.8.html index 69ad6cb..1b921cd 100644 --- a/zfs-tpm1x-load-key.8.html +++ b/zfs-tpm1x-load-key.8.html @@ -1,146 +1,111 @@ - - - zfs-tpm1x-load-key(8) - load tzpfms TPM1.X-encrypted ZFS dataset key - + + + + ZFS-TPM1X-LOAD-KEY(8) - - -
- - - -
    -
  1. zfs-tpm1x-load-key(8)
    2. -
  2. -
  3. zfs-tpm1x-load-key(8)
    4. -
- - - -

NAME

-

- zfs-tpm1x-load-key - load tzpfms TPM1.X-encrypted ZFS dataset key -

-

SYNOPSIS

- -

zfs-tpm1x-load-key [-n] dataset

- -

DESCRIPTION

- -

zfs-tpm1x-load-key(8), after verifying that dataset was encrypted with tzpfms backend TPM1.X will unseal the key and load it into dataset.

- -

The user is prompted for, first, the SRK passphrase, set when taking ownership, if it's not "well-known" (all zeroes), -then the additional passphrase set when creating the key, if it was provided.

- -

See zfs-tpm1x-change-key(8) for a detailed description.

- -

OPTIONS

- -
-
-n
-
Do a no-op/dry run, can be used even if the key is already loaded. Equivalent to zfs(8) load-key's -n option.
+ + + + + + + +
ZFS-TPM1X-LOAD-KEY(8)System Manager's ManualZFS-TPM1X-LOAD-KEY(8)
+
+
+

+

zfs-tpm1x-load-key — + load tzpfms TPM1.X-encrypted ZFS dataset key

+
+
+

+ + + + + +
zfs-tpm1x-load-key[-n] dataset
+
+
+

+

After verifying dataset was encrypted with + tzpfms backend + + will unseal the key and load it into dataset.

+

The user is prompted for, first, the SRK passphrase, set when + taking ownership, if it's not "well-known" (all zeroes), then the + additional passphrase set when creating the key, if it was provided.

+

See + zfs-tpm1x-change-key(8) + for a detailed description.

+
+
+

+
+
+
Do a no-op/dry run, can be used even if the key is already loaded. + Equivalent to zfs + load-key's -n option.
- -

TPM1.X back-end configuration

- -

TPM selection

- -

The tzpfms suite connects to a local tcsd(8) process (at localhost:30003) by default. -Use the environment variable TZPFMS_TPM1X to specify a remote TCS hostname.

- -

The TrouSerS tcsd(8) daemon will try /dev/tpm0, then /udev/tpm0, then /dev/tpm; -by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected.

- -

See also

- -

The TrouSerS project page at https://sourceforge.net/projects/trousers.

- -

The TPM 1.2 main specification index at <https://trustedcomputinggroup.org/resource/tpm-main-specification>.

- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- -
    +
+
+

+
+

+

The tzpfms suite connects to a local + tcsd(8) + process (at localhost:30003) by default. Use the + environment variable TZPFMS_TPM1X to specify a + remote TCS hostname.

+

The TrouSerS + tcsd(8) + daemon will try /dev/tpm0, then + /udev/tpm0, then /dev/tpm; + by occupying one of the earlier ones with, for example, shell redirection, a + later one can be selected.

+
+
+

+

The TrouSerS project page at + https://sourceforge.net/projects/trousers.

+

The TPM 1.2 main specification index at + https://trustedcomputinggroup.org/resource/tpm-main-specification.

+
+
+
+

+

To all who support further development, in particular:

+
  • ThePhD
  • Embark Studios
- -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

- -
    -
  1. tzpfms developers
    2. -
  2. January 2021
    3. -
  3. zfs-tpm1x-load-key(8)
    4. -
- -
+ +
+

+

https://todo.sr.ht/~nabijaczleweli/tzpfms

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+
+

+

https://git.sr.ht/~nabijaczleweli/tzpfms

+
+
+ + + + + +
October 15, 2021tzpfms 0.1-5
diff --git a/zfs-tpm1x-load-key.8.html_fragment b/zfs-tpm1x-load-key.8.html_fragment deleted file mode 100644 index 7601a66..0000000 --- a/zfs-tpm1x-load-key.8.html_fragment +++ /dev/null @@ -1,65 +0,0 @@ -
- -

NAME

-

- zfs-tpm1x-load-key - load tzpfms TPM1.X-encrypted ZFS dataset key -

-

SYNOPSIS

- -

zfs-tpm1x-load-key [-n] dataset

- -

DESCRIPTION

- -

zfs-tpm1x-load-key(8), after verifying that dataset was encrypted with tzpfms backend TPM1.X will unseal the key and load it into dataset.

- -

The user is prompted for, first, the SRK passphrase, set when taking ownership, if it's not "well-known" (all zeroes), -then the additional passphrase set when creating the key, if it was provided.

- -

See zfs-tpm1x-change-key(8) for a detailed description.

- -

OPTIONS

- -
-
-n
-
Do a no-op/dry run, can be used even if the key is already loaded. Equivalent to zfs(8) load-key's -n option.
-
- -

TPM1.X back-end configuration

- -

TPM selection

- -

The tzpfms suite connects to a local tcsd(8) process (at localhost:30003) by default. -Use the environment variable TZPFMS_TPM1X to specify a remote TCS hostname.

- -

The TrouSerS tcsd(8) daemon will try /dev/tpm0, then /udev/tpm0, then /dev/tpm; -by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected.

- -

See also

- -

The TrouSerS project page at https://sourceforge.net/projects/trousers.

- -

The TPM 1.2 main specification index at <https://trustedcomputinggroup.org/resource/tpm-main-specification>.

- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- -
    -
  • ThePhD
    • -
  • Embark Studios
    • -
- -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

-
diff --git a/zfs-tpm1x-load-key.md b/zfs-tpm1x-load-key.md deleted file mode 100644 index 6a1ad8d..0000000 --- a/zfs-tpm1x-load-key.md +++ /dev/null @@ -1,57 +0,0 @@ -zfs-tpm1x-load-key(8) -- load tzpfms TPM1.X-encrypted ZFS dataset key -===================================================================== - -## SYNOPSIS - -`zfs-tpm1x-load-key` [-n] - -## DESCRIPTION - -zfs-tpm1x-load-key(8), after verifying that `dataset` was encrypted with tzpfms backend *TPM1.X* will unseal the key and load it into `dataset`. - -The user is prompted for, first, the SRK passphrase, set when taking ownership, if it's not "well-known" (all zeroes), -then the additional passphrase set when creating the key, if it was provided. - -See zfs-tpm1x-change-key(8) for a detailed description. - -## OPTIONS - - * `-n`: - Do a no-op/dry run, can be used even if the key is already loaded. Equivalent to **zfs(8) load-key**'s `-n` option. - -## TPM1.X back-end configuration - -### TPM selection - -The tzpfms suite connects to a local tcsd(8) process (at `localhost:30003`) by default. -Use the environment variable `TZPFMS_TPM1X` to specify a remote TCS hostname. - -The TrouSerS tcsd(8) daemon will try `/dev/tpm0`, then `/udev/tpm0`, then `/dev/tpm`; -by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected. - -### See also - -The TrouSerS project page at . - -The TPM 1.2 main specification index at <>. - -## AUTHOR - -Written by наб <> - -## SPECIAL THANKS - -To all who support further development, in particular: - - * ThePhD - * Embark Studios - -## REPORTING BUGS - -<> - -<>, archived at <> - -## SEE ALSO - -<> diff --git a/zfs-tpm2-change-key.8 b/zfs-tpm2-change-key.8 index 984d567..69ee7e4 100644 --- a/zfs-tpm2-change-key.8 +++ b/zfs-tpm2-change-key.8 @@ -1,62 +1,153 @@ -.\" generated with Ronn-NG/v0.9.1 -.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 -.TH "ZFS\-TPM2\-CHANGE\-KEY" "8" "January 2021" "tzpfms developers" -.SH "NAME" -\fBzfs\-tpm2\-change\-key\fR \- change ZFS dataset key to one stored on the TPM -.SH "SYNOPSIS" -\fBzfs\-tpm2\-change\-key\fR [\-b file] \fIdataset\fR -.SH "DESCRIPTION" -To normalise \fBdataset\fR, zfs\-tpm2\-change\-key(8) will open its encryption root in its stead\. zfs\-tpm2\-change\-key(8) will \fInever\fR create or destroy encryption roots; use \fBzfs(8) change\-key\fR for that\. -.P -First, a connection is made to the TPM, which \fImust\fR be TPM\-2\.0\-compatible\. -.P -If \fBdataset\fR was previously encrypted with tzpfms and the \fITPM2\fR back\-end was used, the previous key will be freed from the TPM\. Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream\. -.P -Next, a new wrapping key is be generated on the TPM, optionally backed up (see \fIOPTIONS\fR), and sealed to a persistent object on the TPM under the owner hierarchy; if there is a passphrase set on the owner hierarchy, the user is prompted for it; the user is always prompted for an optional passphrase to protect the sealed object with\. -.P -The following properties are set on \fBdataset\fR: -.IP "\[ci]" 4 -\fBxyz\.nabijaczleweli:tzpfms\.backend\fR=\fBTPM2\fR -.IP "\[ci]" 4 -\fBxyz\.nabijaczleweli:tzpfms\.key\fR=\fI(ID of persistent object)\fR -.IP "" 0 -.P -\fBtzpfms\.backend\fR identifies this dataset for work with \fITPM2\fR\-back\-ended tzpfms tools (namely zfs\-tpm2\-change\-key(8), zfs\-tpm2\-load\-key(8), and zfs\-tpm2\-clear\-key(8))\. -.P -\fBtzpfms\.key\fR is an integer representing the sealed object; if needed, it can be passed to \fBtpm2_unseal(1) \-c ${tzpfms\.key} [\-p ${password}]\fR or equivalent for back\-up (see \fIOPTIONS\fR)\. If you have a sealed key you can access with that or equivalent tool and set both of these properties, it will funxion seamlessly\. -.P -Finally, the equivalent of \fBzfs(8) change\-key \-o keylocation=prompt \-o keyformat=raw dataset\fR is performed with the new key\. If an error occurred, best effort is made to clean up the persistent object and properties, or to issue a note for manual intervention into the standard error stream\. -.P -A final verification should be made by running \fBzfs\-tpm2\-load\-key(8) \-n dataset\fR\. If that command succeeds, all is well, but otherwise the dataset can be manually rolled back to a password with \fBzfs\-tpm2\-clear\-key(8) dataset\fR (or, if that fails to work, \fBzfs(8) change\-key \-o keyformat=passphrase dataset\fR), and you are hereby asked to report a bug, please\. -.P -\fBzfs\-tpm2\-clear\-key(8) dataset\fR can be used to free the TPM persistent object and go back to using a password\. -.SH "OPTIONS" -.TP -\fB\-b\fR \fIfile\fR -Save a back\-up of the key to \fIfile\fR, which must not exist beforehand\. This back\-up \fBmust\fR be stored securely, off\-site\. In case of a catastrophic event, the key can be loaded by running \fBzfs(8) load\-key dataset < backup\-file\fR\. -.SH "TPM2 back\-end configuration" -.SS "Environment variables" -.TP -\fBTSS2_LOG\fR= -Any of: \fINONE\fR, \fIERROR\fR, \fIWARNING\fR, \fIINFO\fR, \fIDEBUG\fR, \fITRACE\fR\. Default: \fIWARNING\fR\. -.SS "TPM selection" -The library \fBlibtss2\-tcti\-default\.so\fR can be linked to any of the \fBlibtss2\-tcti\-*\.so\fR libraries to select the default, otherwise \fB/dev/tpmrm0\fR, then \fB/dev/tpm0\fR, then \fBlocalhost:2321\fR will be tried, in order (see ESYS_CONTEXT(3))\. -.SS "See also" -The tpm2\-tss git repository at \fIhttps://github\.com/tpm2\-software/tpm2\-tss\fR and the documentation at \fIhttps://tpm2\-tss\.readthedocs\.io\fR\. -.P -The TPM 2\.0 specifications, mainly at <\fIhttps://trustedcomputinggroup\.org/wp\-content/uploads/TPM\-Rev\-2\.0\-Part\-1\-Architecture\-01\.38\.pdf\fR> and related pages\. -.SH "AUTHOR" -Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR> -.SH "SPECIAL THANKS" +.Dd October 15, 2021 +.ds doc-volume-operating-system +.Dt ZFS-TPM2-CHANGE-KEY 8 +.Os tzpfms 0.1-5 +. +.Sh NAME +.Nm zfs-tpm2-change-key +.Nd change ZFS dataset key to one stored on the TPM +.Sh SYNOPSIS +.Nm +.Op Fl b Ar backup-file +.Ar dataset +. +.Sh DESCRIPTION +To normalise +.Ar dataset , +.Nm +will open its encryption root in its stead. +.Nm +will +.Em never +create or destroy encryption roots; use +.Xr zfs-change-key 8 +for that. +.Pp +First, a connection is made to the TPM, which +.Em must +be TPM-2.0-compatible. +.Pp +If +.Ar dataset +was previously encrypted with +.Nm tzpfms +and the +.Sy TPM2 +back-end was used, the previous key will be freed from the TPM. +Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream. +.Pp +Next, a new wrapping key is be generated on the TPM, optionally backed up +.Pq see Sx OPTIONS , +and sealed to a persistent object on the TPM under the owner hierarchy; +if there is a passphrase set on the owner hierarchy, the user is prompted for it; +the user is always prompted for an optional passphrase to protect the sealed object with. +.Pp +The following properties are set on +.Ar dataset : +.Bl -bullet -compact -offset 4n -width "" +.\"" TODO: width? +.It +.Li xyz.nabijaczleweli:tzpfms.backend Ns = Ns Sy TPM2 +.It +.Li xyz.nabijaczleweli:tzpfms.key Ns = Ns Ar ID of persistent object +.El +.Pp +.Li tzpfms.backend +identifies this dataset for work with +.Sy TPM2 Ns -back-ended +.Nm tzpfms +tools +.Pq namely Xr zfs-tpm2-change-key 8 , Xr zfs-tpm2-load-key 8 , and Xr zfs-tpm2-clear-key 8 . +.Pp +.Li tzpfms.key +is an integer representing the sealed object; +if needed, it can be passed to +.Nm tpm2_unseal Fl c Ev ${tzpfms.key} Op Fl p Ev ${password} +or equivalent for back-up +.Pq see Sx OPTIONS . +If you have a sealed key you can access with that or equivalent tool and set both of these properties, it will funxion seamlessly. +.Pp +Finally, the equivalent of +.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=raw Ar dataset +is performed with the new key. +If an error occurred, best effort is made to clean up the persistent object and properties, +or to issue a note for manual intervention into the standard error stream. +.Pp +A final verification should be made by running +.Nm zfs-tpm2-load-key Fl n Ar dataset . +If that command succeeds, all is well, +but otherwise the dataset can be manually rolled back to a password with +.Nm zfs-tpm2-clear-key Ar dataset +.Pq or, if that fails to work, Nm zfs Cm change-key Fl o Li keyformat=passphrase Ar dataset , +and you are hereby asked to report a bug, please. +.Pp +.Nm zfs-tpm2-clear-key Ar dataset +can be used to free the TPM persistent object and go back to using a password. +. +.Sh OPTIONS +.Bl -tag -compact -width "-b backup-file" +.It Fl b Ar backup-file +Save a back-up of the key to +.Ar backup-file , +which must not exist beforehand. +This back-up +.Em must +be stored securely, off-site. +In case of a catastrophic event, the key can be loaded by running +.Dl Nm zfs Cm load-key Ar dataset Li < Ar backup-file +.El +. +.Sh TPM2 back-end configuration +.Ss Environment variables +.Bl -tag -compact -width "TSS2_LOG" +.It Ev TSS2_LOG +Any of: +.Sy NONE , ERROR , WARNING , INFO , DEBUG , TRACE . +Default: +.Sy WARNING . +.El +. +.Ss TPM selection +The library +.Nm libtss2-tcti-default.so +can be linked to any of the +.Pa libtss2-tcti-*.so +libraries to select the default, otherwise +.Pa /dev/tpmrm0 , +then +.Pa /dev/tpm0 , +then +.Pa localhost:2321 +will be tried, in order +.Pq see Xr ESYS_CONTEXT 3 . +. +.Ss See also +The tpm2-tss git repository at +.Lk https:/\&/github.com/tpm2-software/tpm2-tss +and the documentation at +.Lk https:/\&/tpm2-tss.readthedocs.io . +.Pp +The TPM 2.0 specifications, mainly at +.Lk https:/\&/trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf +and related pages. +. +.Sh SPECIAL THANKS To all who support further development, in particular: -.IP "\[ci]" 4 +.Bl -bullet -offset 4n -compact -width 0 +.It ThePhD -.IP "\[ci]" 4 +.It Embark Studios -.IP "" 0 -.SH "REPORTING BUGS" -<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.P -<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.SH "SEE ALSO" -<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR> +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/~nabijaczleweli/tzpfms +.Pp +.Mt ~nabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/~nabijaczleweli/tzpfms . +. +.Sh SEE ALSO +.Xr tpm2_unseal 1 +.Pp +.Lk https:/\&/git.sr.ht/~nabijaczleweli/tzpfms diff --git a/zfs-tpm2-change-key.8.html b/zfs-tpm2-change-key.8.html index 2d7f839..152df30 100644 --- a/zfs-tpm2-change-key.8.html +++ b/zfs-tpm2-change-key.8.html @@ -1,189 +1,183 @@ - - - zfs-tpm2-change-key(8) - change ZFS dataset key to one stored on the TPM - + + + + ZFS-TPM2-CHANGE-KEY(8) - - -
- - - -
    -
  1. zfs-tpm2-change-key(8)
    2. -
  2. -
  3. zfs-tpm2-change-key(8)
    4. -
- - - -

NAME

-

- zfs-tpm2-change-key - change ZFS dataset key to one stored on the TPM -

-

SYNOPSIS

- -

zfs-tpm2-change-key [-b file] dataset

- -

DESCRIPTION

- -

To normalise dataset, zfs-tpm2-change-key(8) will open its encryption root in its stead. -zfs-tpm2-change-key(8) will never create or destroy encryption roots; use zfs(8) change-key for that.

- -

First, a connection is made to the TPM, which must be TPM-2.0-compatible.

- -

If dataset was previously encrypted with tzpfms and the TPM2 back-end was used, the previous key will be freed from the TPM. -Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream.

- -

Next, a new wrapping key is be generated on the TPM, optionally backed up (see OPTIONS), -and sealed to a persistent object on the TPM under the owner hierarchy; -if there is a passphrase set on the owner hierarchy, the user is prompted for it; -the user is always prompted for an optional passphrase to protect the sealed object with.

- -

The following properties are set on dataset:

- -
    -
  • -xyz.nabijaczleweli:tzpfms.backend=TPM2 -
    • -
  • -xyz.nabijaczleweli:tzpfms.key=(ID of persistent object) -
    • + + + + + + + +
    ZFS-TPM2-CHANGE-KEY(8)System Manager's ManualZFS-TPM2-CHANGE-KEY(8)
    +
    +
    +

    +

    zfs-tpm2-change-key — + change ZFS dataset key to one stored on the TPM

    +
    +
    +

    + + + + + +
    zfs-tpm2-change-key[-b backup-file] + dataset
    +
    +
    +

    +

    To normalise dataset, + zfs-tpm2-change-key will open its encryption root in + its stead. zfs-tpm2-change-key will + + create or destroy encryption roots; use + zfs-change-key(8) + for that.

    +

    First, a connection is made to the TPM, which + must be TPM-2.0-compatible.

    +

    If dataset was previously encrypted with + tzpfms and the TPM2 back-end was + used, the previous key will be freed from the TPM. Otherwise, or in case of + an error, data required for manual intervention will be printed to the + standard error stream.

    +

    Next, a new wrapping key is be generated on the TPM, optionally + backed up (see OPTIONS), and sealed to a + persistent object on the TPM under the owner hierarchy; if there is a + passphrase set on the owner hierarchy, the user is prompted for it; the user + is always prompted for an optional passphrase to protect the sealed object + with.

    +

    The following properties are set on + dataset:

    + - -

    tzpfms.backend identifies this dataset for work with TPM2-back-ended tzpfms tools -(namely zfs-tpm2-change-key(8), zfs-tpm2-load-key(8), and zfs-tpm2-clear-key(8)).

    - -

    tzpfms.key is an integer representing the sealed object; -if needed, it can be passed to tpm2_unseal(1) -c ${tzpfms.key} [-p ${password}] or equivalent for back-up (see OPTIONS). -If you have a sealed key you can access with that or equivalent tool and set both of these properties, it will funxion seamlessly.

    - -

    Finally, the equivalent of zfs(8) change-key -o keylocation=prompt -o keyformat=raw dataset is performed with the new key. -If an error occurred, best effort is made to clean up the persistent object and properties, -or to issue a note for manual intervention into the standard error stream.

    - -

    A final verification should be made by running zfs-tpm2-load-key(8) -n dataset. -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a password with zfs-tpm2-clear-key(8) dataset (or, if that fails to work, zfs(8) change-key -o keyformat=passphrase dataset), and you are hereby asked to report a bug, please.

    - -

    zfs-tpm2-clear-key(8) dataset can be used to free the TPM persistent object and go back to using a password.

    - -

    OPTIONS

    - -
    -
    --b file -
    -
    Save a back-up of the key to file, which must not exist beforehand. -This back-up must be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running zfs(8) load-key dataset < backup-file.
    +

    tzpfms.backend identifies this dataset for + work with TPM2-back-ended tzpfms + tools (namely + zfs-tpm2-change-key(8), + zfs-tpm2-load-key(8), and + zfs-tpm2-clear-key(8)).

    +

    tzpfms.key is an integer representing the + sealed object; if needed, it can be passed to + tpm2_unseal -c + ${tzpfms.key} [-p + ${password}] or equivalent for back-up (see + OPTIONS). If you have a sealed key you can + access with that or equivalent tool and set both of these properties, it + will funxion seamlessly.

    +

    Finally, the equivalent of zfs + change-key -o + keylocation=prompt -o + keyformat=raw dataset is + performed with the new key. If an error occurred, best effort is made to + clean up the persistent object and properties, or to issue a note for manual + intervention into the standard error stream.

    +

    A final verification should be made by running + zfs-tpm2-load-key -n + dataset. If that command succeeds, all is well, but + otherwise the dataset can be manually rolled back to a password with + zfs-tpm2-clear-key dataset + (or, if that fails to work, zfs + change-key -o + keyformat=passphrase dataset), + and you are hereby asked to report a bug, please.

    +

    zfs-tpm2-clear-key + dataset can be used to free the TPM persistent object + and go back to using a password.

    +
    +
    +

    +
    +
    + backup-file
    +
    Save a back-up of the key to backup-file, which must + not exist beforehand. This back-up must be stored + securely, off-site. In case of a catastrophic event, the key can be loaded + by running +
    zfs + load-key dataset + < + backup-file
    +
    - -

    TPM2 back-end configuration

    - -

    Environment variables

    - -
    -
    -TSS2_LOG=
    -
    Any of: NONE, ERROR, WARNING, INFO, DEBUG, TRACE. Default: WARNING.
    +
    +
    +

    +
    +

    +
    +
    +
    Any of: + , + , + WARNING, + , + , + . + Default: WARNING.
    - -

    TPM selection

    - -

    The library libtss2-tcti-default.so can be linked to any of the libtss2-tcti-*.so libraries to select the default, -otherwise /dev/tpmrm0, then /dev/tpm0, then localhost:2321 will be tried, in order (see ESYS_CONTEXT(3)).

    - -

    See also

    - -

    The tpm2-tss git repository at https://github.com/tpm2-software/tpm2-tss and the documentation at https://tpm2-tss.readthedocs.io.

    - -

    The TPM 2.0 specifications, mainly at <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf> and related pages.

    - -

    AUTHOR

    - -

    Written by наб <nabijaczleweli@nabijaczleweli.xyz>

    - -

    SPECIAL THANKS

    - -

    To all who support further development, in particular:

    - -
      +
    +
    +

    +

    The library libtss2-tcti-default.so can be + linked to any of the libtss2-tcti-*.so libraries to + select the default, otherwise /dev/tpmrm0, then + /dev/tpm0, then + localhost:2321 will be tried, in order (see + ESYS_CONTEXT(3)).

    +
    +
    +

    +

    The tpm2-tss git repository at + https://github.com/tpm2-software/tpm2-tss + and the documentation at + https://tpm2-tss.readthedocs.io.

    +

    The TPM 2.0 specifications, mainly at + https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf + and related pages.

    +
    +
    +
    +

    +

    To all who support further development, in particular:

    +
    • ThePhD
    • Embark Studios
    - -

    REPORTING BUGS

    - -

    <https://todo.sr.ht/~nabijaczleweli/tzpfms>

    - -

    <~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

    - -

    SEE ALSO

    - -

    <https://git.sr.ht/~nabijaczleweli/tzpfms>

    - -
      -
    1. tzpfms developers
      2. -
    2. January 2021
      3. -
    3. zfs-tpm2-change-key(8)
      4. -
    - -
    + +
    +

    +

    https://todo.sr.ht/~nabijaczleweli/tzpfms

    +

    ~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

    +
    +
    +

    +

    tpm2_unseal(1)

    +

    https://git.sr.ht/~nabijaczleweli/tzpfms

    +
    +
+ + + + + +
October 15, 2021tzpfms 0.1-5
diff --git a/zfs-tpm2-change-key.8.html_fragment b/zfs-tpm2-change-key.8.html_fragment deleted file mode 100644 index 764b3a4..0000000 --- a/zfs-tpm2-change-key.8.html_fragment +++ /dev/null @@ -1,108 +0,0 @@ -
- -

NAME

-

- zfs-tpm2-change-key - change ZFS dataset key to one stored on the TPM -

-

SYNOPSIS

- -

zfs-tpm2-change-key [-b file] dataset

- -

DESCRIPTION

- -

To normalise dataset, zfs-tpm2-change-key(8) will open its encryption root in its stead. -zfs-tpm2-change-key(8) will never create or destroy encryption roots; use zfs(8) change-key for that.

- -

First, a connection is made to the TPM, which must be TPM-2.0-compatible.

- -

If dataset was previously encrypted with tzpfms and the TPM2 back-end was used, the previous key will be freed from the TPM. -Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream.

- -

Next, a new wrapping key is be generated on the TPM, optionally backed up (see OPTIONS), -and sealed to a persistent object on the TPM under the owner hierarchy; -if there is a passphrase set on the owner hierarchy, the user is prompted for it; -the user is always prompted for an optional passphrase to protect the sealed object with.

- -

The following properties are set on dataset:

- -
    -
  • -xyz.nabijaczleweli:tzpfms.backend=TPM2 -
    • -
  • -xyz.nabijaczleweli:tzpfms.key=(ID of persistent object) -
    • -
- -

tzpfms.backend identifies this dataset for work with TPM2-back-ended tzpfms tools -(namely zfs-tpm2-change-key(8), zfs-tpm2-load-key(8), and zfs-tpm2-clear-key(8)).

- -

tzpfms.key is an integer representing the sealed object; -if needed, it can be passed to tpm2_unseal(1) -c ${tzpfms.key} [-p ${password}] or equivalent for back-up (see OPTIONS). -If you have a sealed key you can access with that or equivalent tool and set both of these properties, it will funxion seamlessly.

- -

Finally, the equivalent of zfs(8) change-key -o keylocation=prompt -o keyformat=raw dataset is performed with the new key. -If an error occurred, best effort is made to clean up the persistent object and properties, -or to issue a note for manual intervention into the standard error stream.

- -

A final verification should be made by running zfs-tpm2-load-key(8) -n dataset. -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a password with zfs-tpm2-clear-key(8) dataset (or, if that fails to work, zfs(8) change-key -o keyformat=passphrase dataset), and you are hereby asked to report a bug, please.

- -

zfs-tpm2-clear-key(8) dataset can be used to free the TPM persistent object and go back to using a password.

- -

OPTIONS

- -
-
--b file -
-
Save a back-up of the key to file, which must not exist beforehand. -This back-up must be stored securely, off-site. -In case of a catastrophic event, the key can be loaded by running zfs(8) load-key dataset < backup-file.
-
- -

TPM2 back-end configuration

- -

Environment variables

- -
-
-TSS2_LOG=
-
Any of: NONE, ERROR, WARNING, INFO, DEBUG, TRACE. Default: WARNING.
-
- -

TPM selection

- -

The library libtss2-tcti-default.so can be linked to any of the libtss2-tcti-*.so libraries to select the default, -otherwise /dev/tpmrm0, then /dev/tpm0, then localhost:2321 will be tried, in order (see ESYS_CONTEXT(3)).

- -

See also

- -

The tpm2-tss git repository at https://github.com/tpm2-software/tpm2-tss and the documentation at https://tpm2-tss.readthedocs.io.

- -

The TPM 2.0 specifications, mainly at <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf> and related pages.

- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- -
    -
  • ThePhD
    • -
  • Embark Studios
    • -
- -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

-
diff --git a/zfs-tpm2-change-key.md b/zfs-tpm2-change-key.md deleted file mode 100644 index 5cafbbe..0000000 --- a/zfs-tpm2-change-key.md +++ /dev/null @@ -1,89 +0,0 @@ -zfs-tpm2-change-key(8) -- change ZFS dataset key to one stored on the TPM -========================================================================= - -## SYNOPSIS - -`zfs-tpm2-change-key` [-b file] - -## DESCRIPTION - -To normalise `dataset`, zfs-tpm2-change-key(8) will open its encryption root in its stead. -zfs-tpm2-change-key(8) will *never* create or destroy encryption roots; use **zfs(8) change-key** for that. - -First, a connection is made to the TPM, which *must* be TPM-2.0-compatible. - -If `dataset` was previously encrypted with tzpfms and the *TPM2* back-end was used, the previous key will be freed from the TPM. -Otherwise, or in case of an error, data required for manual intervention will be printed to the standard error stream. - -Next, a new wrapping key is be generated on the TPM, optionally backed up (see [OPTIONS][]), -and sealed to a persistent object on the TPM under the owner hierarchy; -if there is a passphrase set on the owner hierarchy, the user is prompted for it; -the user is always prompted for an optional passphrase to protect the sealed object with. - -The following properties are set on `dataset`: - - * `xyz.nabijaczleweli:tzpfms.backend`=`TPM2` - * `xyz.nabijaczleweli:tzpfms.key`=*(ID of persistent object)* - -`tzpfms.backend` identifies this dataset for work with *TPM2*-back-ended tzpfms tools -(namely zfs-tpm2-change-key(8), zfs-tpm2-load-key(8), and zfs-tpm2-clear-key(8)). - -`tzpfms.key` is an integer representing the sealed object; -if needed, it can be passed to **tpm2_unseal(1) -c ${tzpfms.key} [-p ${password}]** or equivalent for back-up (see [OPTIONS][]). -If you have a sealed key you can access with that or equivalent tool and set both of these properties, it will funxion seamlessly. - -Finally, the equivalent of **zfs(8) change-key -o keylocation=prompt -o keyformat=raw dataset** is performed with the new key. -If an error occurred, best effort is made to clean up the persistent object and properties, -or to issue a note for manual intervention into the standard error stream. - -A final verification should be made by running **zfs-tpm2-load-key(8) -n dataset**. -If that command succeeds, all is well, -but otherwise the dataset can be manually rolled back to a password with **zfs-tpm2-clear-key(8) dataset** (or, if that fails to work, **zfs(8) change-key -o keyformat=passphrase dataset**), and you are hereby asked to report a bug, please. - -**zfs-tpm2-clear-key(8) dataset** can be used to free the TPM persistent object and go back to using a password. - -## OPTIONS - - * `-b` *file*: - Save a back-up of the key to *file*, which must not exist beforehand. - This back-up **must** be stored securely, off-site. - In case of a catastrophic event, the key can be loaded by running **zfs(8) load-key dataset < backup-file**. - -## TPM2 back-end configuration - -### Environment variables - - * `TSS2_LOG`=: - Any of: *NONE*, *ERROR*, *WARNING*, *INFO*, *DEBUG*, *TRACE*. Default: *WARNING*. - -### TPM selection - -The library `libtss2-tcti-default.so` can be linked to any of the `libtss2-tcti-*.so` libraries to select the default, -otherwise `/dev/tpmrm0`, then `/dev/tpm0`, then `localhost:2321` will be tried, in order (see ESYS_CONTEXT(3)). - -### See also - -The tpm2-tss git repository at and the documentation at . - -The TPM 2.0 specifications, mainly at <> and related pages. - -## AUTHOR - -Written by наб <> - -## SPECIAL THANKS - -To all who support further development, in particular: - - * ThePhD - * Embark Studios - -## REPORTING BUGS - -<> - -<>, archived at <> - -## SEE ALSO - -<> diff --git a/zfs-tpm2-clear-key.8 b/zfs-tpm2-clear-key.8 index f353fc3..ca0bf51 100644 --- a/zfs-tpm2-clear-key.8 +++ b/zfs-tpm2-clear-key.8 @@ -1,44 +1,89 @@ -.\" generated with Ronn-NG/v0.9.1 -.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 -.TH "ZFS\-TPM2\-CLEAR\-KEY" "8" "January 2021" "tzpfms developers" -.SH "NAME" -\fBzfs\-tpm2\-clear\-key\fR \- rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata -.SH "SYNOPSIS" -\fBzfs\-tpm2\-clear\-key\fR \fIdataset\fR -.SH "DESCRIPTION" -zfs\-tpm2\-clear\-key(8), after verifying that \fBdataset\fR was encrypted with tzpfms backend \fITPM2\fR will: -.IP "1." 4 -perform the equivalent of \fBzfs(8) change\-key \-o keylocation=prompt \-o keyformat=passphrase dataset\fR, -.IP "2." 4 -free the sealed key previously used to encrypt \fBdataset\fR, -.IP "3." 4 -remove the \fBxyz\.nabijaczleweli:tzpfms\.{backend,key}\fR properties from \fBdataset\fR\. -.IP "" 0 -.P -See zfs\-tpm2\-change\-key(8) for a detailed description\. -.SH "TPM2 back\-end configuration" -.SS "Environment variables" -.TP -\fBTSS2_LOG\fR= -Any of: \fINONE\fR, \fIERROR\fR, \fIWARNING\fR, \fIINFO\fR, \fIDEBUG\fR, \fITRACE\fR\. Default: \fIWARNING\fR\. -.SS "TPM selection" -The library \fBlibtss2\-tcti\-default\.so\fR can be linked to any of the \fBlibtss2\-tcti\-*\.so\fR libraries to select the default, otherwise \fB/dev/tpmrm0\fR, then \fB/dev/tpm0\fR, then \fBlocalhost:2321\fR will be tried, in order (see ESYS_CONTEXT(3))\. -.SS "See also" -The tpm2\-tss git repository at \fIhttps://github\.com/tpm2\-software/tpm2\-tss\fR and the documentation at \fIhttps://tpm2\-tss\.readthedocs\.io\fR\. -.P -The TPM 2\.0 specifications, mainly at <\fIhttps://trustedcomputinggroup\.org/wp\-content/uploads/TPM\-Rev\-2\.0\-Part\-1\-Architecture\-01\.38\.pdf\fR> and related pages\. -.SH "AUTHOR" -Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR> -.SH "SPECIAL THANKS" +.Dd October 15, 2021 +.ds doc-volume-operating-system +.Dt ZFS-TPM2-CLEAR-KEY 8 +.Os tzpfms 0.1-5 +. +.Sh NAME +.Nm zfs-tpm2-clear-key +.Nd rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata +.Sh SYNOPSIS +.Nm +.Ar dataset +. +.Sh DESCRIPTION +After verifying +.Ar dataset +was encrypted with +.Nm tzpfms +backend +.Sy TPM2 : +.Bl -enum -compact -offset 4n -width "" +.It +performs the equivalent of +.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset , +.It +frees the sealed key previously used to encrypt +.Ar dataset , +.It +removes the +.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key +properties from +.Ar dataset . +.El +.Pp +See +.Xr zfs-tpm2-change-key 8 +for a detailed description. +. +.Sh TPM2 back-end configuration +.Ss Environment variables +.Bl -tag -compact -width "TSS2_LOG" +.It Ev TSS2_LOG +Any of: +.Sy NONE , ERROR , WARNING , INFO , DEBUG , TRACE . +Default: +.Sy WARNING . +.El +. +.Ss TPM selection +The library +.Nm libtss2-tcti-default.so +can be linked to any of the +.Pa libtss2-tcti-*.so +libraries to select the default, otherwise +.Pa /dev/tpmrm0 , +then +.Pa /dev/tpm0 , +then +.Pa localhost:2321 +will be tried, in order +.Pq see Xr ESYS_CONTEXT 3 . +. +.Ss See also +The tpm2-tss git repository at +.Lk https:/\&/github.com/tpm2-software/tpm2-tss +and the documentation at +.Lk https:/\&/tpm2-tss.readthedocs.io . +.Pp +The TPM 2.0 specifications, mainly at +.Lk https:/\&/trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf +and related pages. +. +.Sh SPECIAL THANKS To all who support further development, in particular: -.IP "\[ci]" 4 +.Bl -bullet -offset 4n -compact -width 0 +.It ThePhD -.IP "\[ci]" 4 +.It Embark Studios -.IP "" 0 -.SH "REPORTING BUGS" -<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.P -<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.SH "SEE ALSO" -<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR> +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/~nabijaczleweli/tzpfms +.Pp +.Mt ~nabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/~nabijaczleweli/tzpfms . +. +.Sh SEE ALSO +.Lk https:/\&/git.sr.ht/~nabijaczleweli/tzpfms diff --git a/zfs-tpm2-clear-key.8.html b/zfs-tpm2-clear-key.8.html index f5c4882..f1b6a73 100644 --- a/zfs-tpm2-clear-key.8.html +++ b/zfs-tpm2-clear-key.8.html @@ -1,146 +1,125 @@ - - - zfs-tpm2-clear-key(8) - rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata - + + + + ZFS-TPM2-CLEAR-KEY(8) - - -
- - - -
    -
  1. zfs-tpm2-clear-key(8)
    2. -
  2. -
  3. zfs-tpm2-clear-key(8)
    4. -
- - - -

NAME

-

- zfs-tpm2-clear-key - rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata -

-

SYNOPSIS

- -

zfs-tpm2-clear-key dataset

- -

DESCRIPTION

- -

zfs-tpm2-clear-key(8), after verifying that dataset was encrypted with tzpfms backend TPM2 will:

- -
    -
  1. perform the equivalent of zfs(8) change-key -o keylocation=prompt -o keyformat=passphrase dataset,
    2. -
  2. free the sealed key previously used to encrypt dataset,
    3. -
  3. remove the xyz.nabijaczleweli:tzpfms.{backend,key} properties from dataset.
    4. + + + + + + + +
    ZFS-TPM2-CLEAR-KEY(8)System Manager's ManualZFS-TPM2-CLEAR-KEY(8)
    +
    +
    +

    +

    zfs-tpm2-clear-key — + rewrap ZFS dataset key in passsword and clear tzpfms TPM2 + metadata

    +
    +
    +

    + + + + + +
    zfs-tpm2-clear-keydataset
    +
    +
    +

    +

    After verifying dataset was encrypted with + tzpfms backend + :

    +
      +
    1. performs the equivalent of zfs + change-key -o + keylocation=prompt -o + keyformat=passphrase + dataset,
      2. +
    2. frees the sealed key previously used to encrypt + dataset,
      3. +
    3. removes the + xyz.nabijaczleweli:tzpfms.{backend, + key} properties from + dataset.
    - -

    See zfs-tpm2-change-key(8) for a detailed description.

    - -

    TPM2 back-end configuration

    - -

    Environment variables

    - -
    -
    -TSS2_LOG=
    -
    Any of: NONE, ERROR, WARNING, INFO, DEBUG, TRACE. Default: WARNING.
    +

    See + zfs-tpm2-change-key(8) + for a detailed description.

    +
    +
    +

    +
    +

    +
    +
    +
    Any of: + , + , + WARNING, + , + , + . + Default: WARNING.
    - -

    TPM selection

    - -

    The library libtss2-tcti-default.so can be linked to any of the libtss2-tcti-*.so libraries to select the default, -otherwise /dev/tpmrm0, then /dev/tpm0, then localhost:2321 will be tried, in order (see ESYS_CONTEXT(3)).

    - -

    See also

    - -

    The tpm2-tss git repository at https://github.com/tpm2-software/tpm2-tss and the documentation at https://tpm2-tss.readthedocs.io.

    - -

    The TPM 2.0 specifications, mainly at <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf> and related pages.

    - -

    AUTHOR

    - -

    Written by наб <nabijaczleweli@nabijaczleweli.xyz>

    - -

    SPECIAL THANKS

    - -

    To all who support further development, in particular:

    - -
      +
    +
    +

    +

    The library libtss2-tcti-default.so can be + linked to any of the libtss2-tcti-*.so libraries to + select the default, otherwise /dev/tpmrm0, then + /dev/tpm0, then + localhost:2321 will be tried, in order (see + ESYS_CONTEXT(3)).

    +
    +
    +

    +

    The tpm2-tss git repository at + https://github.com/tpm2-software/tpm2-tss + and the documentation at + https://tpm2-tss.readthedocs.io.

    +

    The TPM 2.0 specifications, mainly at + https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf + and related pages.

    +
    +
    +
    +

    +

    To all who support further development, in particular:

    +
    • ThePhD
    • Embark Studios
    - -

    REPORTING BUGS

    - -

    <https://todo.sr.ht/~nabijaczleweli/tzpfms>

    - -

    <~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

    - -

    SEE ALSO

    - -

    <https://git.sr.ht/~nabijaczleweli/tzpfms>

    - -
      -
    1. tzpfms developers
      2. -
    2. January 2021
      3. -
    3. zfs-tpm2-clear-key(8)
      4. -
    - -
    + +
    +

    +

    https://todo.sr.ht/~nabijaczleweli/tzpfms

    +

    ~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

    +
    +
    +

    +

    https://git.sr.ht/~nabijaczleweli/tzpfms

    +
    +
+ + + + + +
October 15, 2021tzpfms 0.1-5
diff --git a/zfs-tpm2-clear-key.8.html_fragment b/zfs-tpm2-clear-key.8.html_fragment deleted file mode 100644 index e05f9d7..0000000 --- a/zfs-tpm2-clear-key.8.html_fragment +++ /dev/null @@ -1,66 +0,0 @@ -
- -

NAME

-

- zfs-tpm2-clear-key - rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata -

-

SYNOPSIS

- -

zfs-tpm2-clear-key dataset

- -

DESCRIPTION

- -

zfs-tpm2-clear-key(8), after verifying that dataset was encrypted with tzpfms backend TPM2 will:

- -
    -
  1. perform the equivalent of zfs(8) change-key -o keylocation=prompt -o keyformat=passphrase dataset,
    2. -
  2. free the sealed key previously used to encrypt dataset,
    3. -
  3. remove the xyz.nabijaczleweli:tzpfms.{backend,key} properties from dataset.
    4. -
- -

See zfs-tpm2-change-key(8) for a detailed description.

- -

TPM2 back-end configuration

- -

Environment variables

- -
-
-TSS2_LOG=
-
Any of: NONE, ERROR, WARNING, INFO, DEBUG, TRACE. Default: WARNING.
-
- -

TPM selection

- -

The library libtss2-tcti-default.so can be linked to any of the libtss2-tcti-*.so libraries to select the default, -otherwise /dev/tpmrm0, then /dev/tpm0, then localhost:2321 will be tried, in order (see ESYS_CONTEXT(3)).

- -

See also

- -

The tpm2-tss git repository at https://github.com/tpm2-software/tpm2-tss and the documentation at https://tpm2-tss.readthedocs.io.

- -

The TPM 2.0 specifications, mainly at <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf> and related pages.

- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- -
    -
  • ThePhD
    • -
  • Embark Studios
    • -
- -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

-
diff --git a/zfs-tpm2-clear-key.md b/zfs-tpm2-clear-key.md deleted file mode 100644 index 674364f..0000000 --- a/zfs-tpm2-clear-key.md +++ /dev/null @@ -1,55 +0,0 @@ -zfs-tpm2-clear-key(8) -- rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata -=========================================================================================== - -## SYNOPSIS - -`zfs-tpm2-clear-key` - -## DESCRIPTION - -zfs-tpm2-clear-key(8), after verifying that `dataset` was encrypted with tzpfms backend *TPM2* will: - - 1. perform the equivalent of **zfs(8) change-key -o keylocation=prompt -o keyformat=passphrase dataset**, - 2. free the sealed key previously used to encrypt `dataset`, - 3. remove the `xyz.nabijaczleweli:tzpfms.{backend,key}` properties from `dataset`. - -See zfs-tpm2-change-key(8) for a detailed description. - -## TPM2 back-end configuration - -### Environment variables - - * `TSS2_LOG`=: - Any of: *NONE*, *ERROR*, *WARNING*, *INFO*, *DEBUG*, *TRACE*. Default: *WARNING*. - -### TPM selection - -The library `libtss2-tcti-default.so` can be linked to any of the `libtss2-tcti-*.so` libraries to select the default, -otherwise `/dev/tpmrm0`, then `/dev/tpm0`, then `localhost:2321` will be tried, in order (see ESYS_CONTEXT(3)). - -### See also - -The tpm2-tss git repository at and the documentation at . - -The TPM 2.0 specifications, mainly at <> and related pages. - -## AUTHOR - -Written by наб <> - -## SPECIAL THANKS - -To all who support further development, in particular: - - * ThePhD - * Embark Studios - -## REPORTING BUGS - -<> - -<>, archived at <> - -## SEE ALSO - -<> diff --git a/zfs-tpm2-load-key.8 b/zfs-tpm2-load-key.8 index 6ab47db..1fe6b24 100644 --- a/zfs-tpm2-load-key.8 +++ b/zfs-tpm2-load-key.8 @@ -1,41 +1,85 @@ -.\" generated with Ronn-NG/v0.9.1 -.\" http://github.com/apjanke/ronn-ng/tree/0.9.1 -.TH "ZFS\-TPM2\-LOAD\-KEY" "8" "January 2021" "tzpfms developers" -.SH "NAME" -\fBzfs\-tpm2\-load\-key\fR \- load tzpfms TPM2\-encrypted ZFS dataset key -.SH "SYNOPSIS" -\fBzfs\-tpm2\-load\-key\fR [\-n] \fIdataset\fR -.SH "DESCRIPTION" -zfs\-tpm2\-load\-key(8), after verifying that \fBdataset\fR was encrypted with tzpfms backend \fITPM2\fR will unseal the key and load it into \fBdataset\fR\. -.P -See zfs\-tpm2\-change\-key(8) for a detailed description\. -.SH "OPTIONS" -.TP -\fB\-n\fR -Do a no\-op/dry run, can be used even if the key is already loaded\. Equivalent to \fBzfs(8) load\-key\fR\'s \fB\-n\fR option\. -.SH "TPM2 back\-end configuration" -.SS "Environment variables" -.TP -\fBTSS2_LOG\fR= -Any of: \fINONE\fR, \fIERROR\fR, \fIWARNING\fR, \fIINFO\fR, \fIDEBUG\fR, \fITRACE\fR\. Default: \fIWARNING\fR\. -.SS "TPM selection" -The library \fBlibtss2\-tcti\-default\.so\fR can be linked to any of the \fBlibtss2\-tcti\-*\.so\fR libraries to select the default, otherwise \fB/dev/tpmrm0\fR, then \fB/dev/tpm0\fR, then \fBlocalhost:2321\fR will be tried, in order (see ESYS_CONTEXT(3))\. -.SS "See also" -The tpm2\-tss git repository at \fIhttps://github\.com/tpm2\-software/tpm2\-tss\fR and the documentation at \fIhttps://tpm2\-tss\.readthedocs\.io\fR\. -.P -The TPM 2\.0 specifications, mainly at <\fIhttps://trustedcomputinggroup\.org/wp\-content/uploads/TPM\-Rev\-2\.0\-Part\-1\-Architecture\-01\.38\.pdf\fR> and related pages\. -.SH "AUTHOR" -Written by наб <\fInabijaczleweli@nabijaczleweli\.xyz\fR> -.SH "SPECIAL THANKS" +.Dd October 15, 2021 +.ds doc-volume-operating-system +.Dt ZFS-TPM2-LOAD-KEY 8 +.Os tzpfms 0.1-5 +. +.Sh NAME +.Nm zfs-tpm2-load-key +.Nd load tzpfms TPM2-encrypted ZFS dataset key +.Sh SYNOPSIS +.Nm +.Op Fl n +.Ar dataset +. +.Sh DESCRIPTION +After verifying +.Ar dataset +was encrypted with +.Nm tzpfms +backend +.Sy TPM2 , +unseals the key and loads it into +.Ar dataset . +.Pp +See +.Xr zfs-tpm2-change-key 8 +for a detailed description. +. +.Sh OPTIONS +.Bl -tag -compact -width "-n" +.It Fl n +Do a no-op/dry run, can be used even if the key is already loaded. +Equivalent to +.Nm zfs Cm load-key Ns 's +.Fl n +option. +.El +. +.Sh TPM1.X back-end configuration +.Ss TPM selection +The +.Nm tzpfms +suite connects to a local +.Xr tcsd 8 +process +.Pq at Pa localhost:30003 +by default. +Use the environment variable +.Ev TZPFMS_TPM1X +to specify a remote TCS hostname. +.Pp +The TrouSerS +.Xr tcsd 8 +daemon will try +.Pa /dev/tpm0 , +then +.Pa /udev/tpm0 , +then +.Pa /dev/tpm ; +by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected. +. +.Ss See also +The TrouSerS project page at +.Lk https:/\&/sourceforge.net/projects/trousers . +.Pp +The TPM 1.2 main specification index at +.Lk https:/\&/trustedcomputinggroup.org/resource/tpm-main-specification . +. +.Sh SPECIAL THANKS To all who support further development, in particular: -.IP "\[ci]" 4 +.Bl -bullet -offset 4n -compact -width 0 +.It ThePhD -.IP "\[ci]" 4 +.It Embark Studios -.IP "" 0 -.SH "REPORTING BUGS" -<\fIhttps://todo\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.P -<\fI~nabijaczleweli/tzpfms@lists\.sr\.ht\fR>, archived at <\fIhttps://lists\.sr\.ht/~nabijaczleweli/tzpfms\fR> -.SH "SEE ALSO" -<\fIhttps://git\.sr\.ht/~nabijaczleweli/tzpfms\fR> +.El +. +.Sh REPORTING BUGS +.Lk https:/\&/todo.sr.ht/~nabijaczleweli/tzpfms +.Pp +.Mt ~nabijaczleweli/tzpfms@lists.sr.ht , +archived at +.Lk https:/\&/lists.sr.ht/~nabijaczleweli/tzpfms . +. +.Sh SEE ALSO +.Lk https:/\&/git.sr.ht/~nabijaczleweli/tzpfms diff --git a/zfs-tpm2-load-key.8.html b/zfs-tpm2-load-key.8.html index 3c10925..1ed3a35 100644 --- a/zfs-tpm2-load-key.8.html +++ b/zfs-tpm2-load-key.8.html @@ -1,148 +1,108 @@ - - - zfs-tpm2-load-key(8) - load tzpfms TPM2-encrypted ZFS dataset key - + + + + ZFS-TPM2-LOAD-KEY(8) - - -
- - - -
    -
  1. zfs-tpm2-load-key(8)
    2. -
  2. -
  3. zfs-tpm2-load-key(8)
    4. -
- - - -

NAME

-

- zfs-tpm2-load-key - load tzpfms TPM2-encrypted ZFS dataset key -

-

SYNOPSIS

- -

zfs-tpm2-load-key [-n] dataset

- -

DESCRIPTION

- -

zfs-tpm2-load-key(8), after verifying that dataset was encrypted with tzpfms backend TPM2 will unseal the key and load it into dataset.

- -

See zfs-tpm2-change-key(8) for a detailed description.

- -

OPTIONS

- -
-
-n
-
Do a no-op/dry run, can be used even if the key is already loaded. Equivalent to zfs(8) load-key's -n option.
+ + + + + + + +
ZFS-TPM2-LOAD-KEY(8)System Manager's ManualZFS-TPM2-LOAD-KEY(8)
+
+
+

+

zfs-tpm2-load-key — + load tzpfms TPM2-encrypted ZFS dataset key

+
+
+

+ + + + + +
zfs-tpm2-load-key[-n] dataset
+
+
+

+

After verifying dataset was encrypted with + tzpfms backend + , + unseals the key and loads it into dataset.

+

See + zfs-tpm2-change-key(8) + for a detailed description.

+
+
+

+
+
+
Do a no-op/dry run, can be used even if the key is already loaded. + Equivalent to zfs + load-key's -n option.
- -

TPM2 back-end configuration

- -

Environment variables

- -
-
-TSS2_LOG=
-
Any of: NONE, ERROR, WARNING, INFO, DEBUG, TRACE. Default: WARNING.
-
- -

TPM selection

- -

The library libtss2-tcti-default.so can be linked to any of the libtss2-tcti-*.so libraries to select the default, -otherwise /dev/tpmrm0, then /dev/tpm0, then localhost:2321 will be tried, in order (see ESYS_CONTEXT(3)).

- -

See also

- -

The tpm2-tss git repository at https://github.com/tpm2-software/tpm2-tss and the documentation at https://tpm2-tss.readthedocs.io.

- -

The TPM 2.0 specifications, mainly at <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf> and related pages.

- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- -
    +
+
+

+
+

+

The tzpfms suite connects to a local + tcsd(8) + process (at localhost:30003) by default. Use the + environment variable TZPFMS_TPM1X to specify a + remote TCS hostname.

+

The TrouSerS + tcsd(8) + daemon will try /dev/tpm0, then + /udev/tpm0, then /dev/tpm; + by occupying one of the earlier ones with, for example, shell redirection, a + later one can be selected.

+
+
+

+

The TrouSerS project page at + https://sourceforge.net/projects/trousers.

+

The TPM 1.2 main specification index at + https://trustedcomputinggroup.org/resource/tpm-main-specification.

+
+
+
+

+

To all who support further development, in particular:

+
  • ThePhD
  • Embark Studios
- -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

- -
    -
  1. tzpfms developers
    2. -
  2. January 2021
    3. -
  3. zfs-tpm2-load-key(8)
    4. -
- -
+ +
+

+

https://todo.sr.ht/~nabijaczleweli/tzpfms

+

~nabijaczleweli/tzpfms@lists.sr.ht, + archived at + https://lists.sr.ht/~nabijaczleweli/tzpfms.

+
+
+

+

https://git.sr.ht/~nabijaczleweli/tzpfms

+
+
+ + + + + +
October 15, 2021tzpfms 0.1-5
diff --git a/zfs-tpm2-load-key.8.html_fragment b/zfs-tpm2-load-key.8.html_fragment deleted file mode 100644 index 2354034..0000000 --- a/zfs-tpm2-load-key.8.html_fragment +++ /dev/null @@ -1,67 +0,0 @@ -
- -

NAME

-

- zfs-tpm2-load-key - load tzpfms TPM2-encrypted ZFS dataset key -

-

SYNOPSIS

- -

zfs-tpm2-load-key [-n] dataset

- -

DESCRIPTION

- -

zfs-tpm2-load-key(8), after verifying that dataset was encrypted with tzpfms backend TPM2 will unseal the key and load it into dataset.

- -

See zfs-tpm2-change-key(8) for a detailed description.

- -

OPTIONS

- -
-
-n
-
Do a no-op/dry run, can be used even if the key is already loaded. Equivalent to zfs(8) load-key's -n option.
-
- -

TPM2 back-end configuration

- -

Environment variables

- -
-
-TSS2_LOG=
-
Any of: NONE, ERROR, WARNING, INFO, DEBUG, TRACE. Default: WARNING.
-
- -

TPM selection

- -

The library libtss2-tcti-default.so can be linked to any of the libtss2-tcti-*.so libraries to select the default, -otherwise /dev/tpmrm0, then /dev/tpm0, then localhost:2321 will be tried, in order (see ESYS_CONTEXT(3)).

- -

See also

- -

The tpm2-tss git repository at https://github.com/tpm2-software/tpm2-tss and the documentation at https://tpm2-tss.readthedocs.io.

- -

The TPM 2.0 specifications, mainly at <https://trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf> and related pages.

- -

AUTHOR

- -

Written by наб <nabijaczleweli@nabijaczleweli.xyz>

- -

SPECIAL THANKS

- -

To all who support further development, in particular:

- -
    -
  • ThePhD
    • -
  • Embark Studios
    • -
- -

REPORTING BUGS

- -

<https://todo.sr.ht/~nabijaczleweli/tzpfms>

- -

<~nabijaczleweli/tzpfms@lists.sr.ht>, archived at <https://lists.sr.ht/~nabijaczleweli/tzpfms>

- -

SEE ALSO

- -

<https://git.sr.ht/~nabijaczleweli/tzpfms>

-
diff --git a/zfs-tpm2-load-key.md b/zfs-tpm2-load-key.md deleted file mode 100644 index c9d44f6..0000000 --- a/zfs-tpm2-load-key.md +++ /dev/null @@ -1,56 +0,0 @@ -zfs-tpm2-load-key(8) -- load tzpfms TPM2-encrypted ZFS dataset key -================================================================== - -## SYNOPSIS - -`zfs-tpm2-load-key` [-n] - -## DESCRIPTION - -zfs-tpm2-load-key(8), after verifying that `dataset` was encrypted with tzpfms backend *TPM2* will unseal the key and load it into `dataset`. - -See zfs-tpm2-change-key(8) for a detailed description. - -## OPTIONS - - * `-n`: - Do a no-op/dry run, can be used even if the key is already loaded. Equivalent to **zfs(8) load-key**'s `-n` option. - -## TPM2 back-end configuration - -### Environment variables - - * `TSS2_LOG`=: - Any of: *NONE*, *ERROR*, *WARNING*, *INFO*, *DEBUG*, *TRACE*. Default: *WARNING*. - -### TPM selection - -The library `libtss2-tcti-default.so` can be linked to any of the `libtss2-tcti-*.so` libraries to select the default, -otherwise `/dev/tpmrm0`, then `/dev/tpm0`, then `localhost:2321` will be tried, in order (see ESYS_CONTEXT(3)). - -### See also - -The tpm2-tss git repository at and the documentation at . - -The TPM 2.0 specifications, mainly at <> and related pages. - -## AUTHOR - -Written by наб <> - -## SPECIAL THANKS - -To all who support further development, in particular: - - * ThePhD - * Embark Studios - -## REPORTING BUGS - -<> - -<>, archived at <> - -## SEE ALSO - -<>