NAME

zfs-tpm2-clear-key - rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata

SYNOPSIS

zfs-tpm2-clear-key dataset

DESCRIPTION

zfs-tpm2-clear-key(8), after verifying that dataset was encrypted with tzpfms backend TPM2 will:

perform the equivalent of zfs(8) change-key -o keylocation=prompt -o keyformat=passphrase dataset,
free the sealed key previously used to encrypt dataset,
remove the xyz.nabijaczleweli:tzpfms.{backend,key} properties from dataset.

See zfs-tpm2-change-key(8) for a detailed description.

TPM2 back-end configuration

Environment variables

TSS2_LOG=: Any of: NONE, ERROR, WARNING, INFO, DEBUG, TRACE. Default: WARNING.

TPM selection

The library libtss2-tcti-default.so can be linked to any of the libtss2-tcti-*.so libraries to select the default, otherwise /dev/tpmrm0, then /dev/tpm0, then localhost:2321 will be tried, in order (see ESYS_CONTEXT(3)).