mirror of
https://git.sr.ht/~nabijaczleweli/tzpfms
synced 2025-04-19 09:47:35 +03:00
135 lines
3.2 KiB
Groff
135 lines
3.2 KiB
Groff
.\" SPDX-License-Identifier: MIT
|
|
.
|
|
.Dd March 11, 2024
|
|
.ds doc-volume-operating-system
|
|
.Dt ZFS-TPM2-CLEAR-KEY 8
|
|
.Os tzpfms 0.4.1-1-gfd16dbb
|
|
.
|
|
.Sh NAME
|
|
.Nm zfs-tpm2-clear-key
|
|
.Nd rewrap ZFS dataset key in passsword and clear tzpfms TPM2 metadata
|
|
.Sh SYNOPSIS
|
|
.Nm
|
|
.Ar dataset
|
|
.
|
|
.Sh DESCRIPTION
|
|
After verifying
|
|
.Ar dataset
|
|
was encrypted with the
|
|
.Nm tzpfms
|
|
.Sy TPM2
|
|
backend:
|
|
.Bl -enum -compact -offset 2n -width 2n
|
|
.It
|
|
performs the equivalent of
|
|
.Nm zfs Cm change-key Fl o Li keylocation=prompt Fl o Li keyformat=passphrase Ar dataset ,
|
|
.It
|
|
frees the sealed key previously used to encrypt
|
|
.Ar dataset ,
|
|
.It
|
|
removes the
|
|
.Li xyz.nabijaczleweli:tzpfms.\& Ns Brq Li backend , key
|
|
properties from
|
|
.Ar dataset .
|
|
.El
|
|
.Pp
|
|
See
|
|
.Xr zfs-tpm2-change-key 8
|
|
for a detailed description.
|
|
.
|
|
.\" SPDX-License-Identifier: MIT
|
|
.
|
|
.Sh ENVIRONMENT VARIABLES
|
|
.Bl -tag -compact -width 4n
|
|
.It Ev TZPFMS_PASSPHRASE_HELPER
|
|
By default, passphrases are prompted for and read in on the standard output and input streams.
|
|
If
|
|
.Ev TZPFMS_PASSPHRASE_HELPER
|
|
is set and nonempty, it will be run via
|
|
.Pa /bin/ Ns Nm sh Fl c
|
|
to provide each passphrase, instead.
|
|
.Pp
|
|
The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any.
|
|
The arguments are:
|
|
.Bl -tag -compact -offset 2n -width ".Li $1"
|
|
.It Li $1
|
|
Pre-formatted noun phrase with all the information below, for use as a prompt
|
|
.\" Passphrase for tarta-zoot
|
|
.\" New passphrase for tarta-zoot (again)
|
|
.It Li $2
|
|
Either the dataset name or the element of the TPM hierarchy being prompted for
|
|
.It Li $3
|
|
.Qq new
|
|
if this is for a new passphrase, otherwise blank
|
|
.It Li $4
|
|
.Qq again
|
|
if it's the second prompt for that passphrase, otherwise blank
|
|
.El
|
|
.Pp
|
|
If the helper doesn't exist
|
|
.Pq the shell exits with Sy 127 ,
|
|
a diagnostic is issued and the normal prompt is used as fall-back.
|
|
If it fails for any other reason, the prompting is aborted.
|
|
.
|
|
.
|
|
.El
|
|
.
|
|
.\" SPDX-License-Identifier: MIT
|
|
.
|
|
.Sh TPM2 back-end configuration
|
|
.Ss Environment variables
|
|
.Bl -tag -compact -width ".Ev TSS2_LOG"
|
|
.It Ev TSS2_LOG
|
|
Any of:
|
|
.Sy NONE , ERROR , WARNING , INFO , DEBUG , TRACE .
|
|
Default:
|
|
.Sy WARNING .
|
|
.El
|
|
.
|
|
.Ss TPM selection
|
|
The library
|
|
.Nm libtss2-tcti-default.so
|
|
can be linked to any of the
|
|
.Pa libtss2-tcti-*.so
|
|
libraries to select the default, otherwise
|
|
.Pa /dev/tpmrm0 ,
|
|
then
|
|
.Pa /dev/tpm0 ,
|
|
then
|
|
.Pa localhost:2321
|
|
will be tried, in order
|
|
.Pq see Xr ESYS_CONTEXT 3 .
|
|
.
|
|
.Ss See also
|
|
The tpm2-tss git repository at
|
|
.Lk https:/\&/github.com/tpm2-software/tpm2-tss
|
|
and the documentation at
|
|
.Lk https:/\&/tpm2-tss.readthedocs.io .
|
|
.Pp
|
|
The TPM 2.0 specifications, mainly at
|
|
.Lk https:/\&/trustedcomputinggroup.org/resource/tpm-library-specification/ ,
|
|
.Lk https:/\&/trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-1-Architecture-01.38.pdf ,
|
|
and related pages.
|
|
.
|
|
.\" SPDX-License-Identifier: MIT
|
|
.
|
|
.Sh SPECIAL THANKS
|
|
To all who support further development, in particular:
|
|
.Bl -bullet -offset 4n -compact -width "@"
|
|
.It
|
|
ThePhD
|
|
.It
|
|
Embark Studios
|
|
.It
|
|
Jasper Bekkers
|
|
.It
|
|
EvModder
|
|
.El
|
|
.
|
|
.Sh REPORTING BUGS
|
|
.Lk https:/\&/todo.sr.ht/\(tinabijaczleweli/tzpfms
|
|
.Pp
|
|
.Mt \(tinabijaczleweli/tzpfms@lists.sr.ht ,
|
|
archived at
|
|
.Lk https:/\&/lists.sr.ht/\(tinabijaczleweli/tzpfms .
|