mirror of
https://git.sr.ht/~nabijaczleweli/tzpfms
synced 2025-05-03 10:21:30 +03:00
123 lines
3.0 KiB
Groff
123 lines
3.0 KiB
Groff
.\" SPDX-License-Identifier: MIT
|
|
.
|
|
.Dd November 15, 2021
|
|
.ds doc-volume-operating-system
|
|
.Dt ZFS-TPM2-LOAD-KEY 8
|
|
.Os tzpfms 0.1-15
|
|
.
|
|
.Sh NAME
|
|
.Nm zfs-tpm2-load-key
|
|
.Nd load TPM2-encrypted ZFS dataset key
|
|
.Sh SYNOPSIS
|
|
.Nm
|
|
.Op Fl n
|
|
.Ar dataset
|
|
.
|
|
.Sh DESCRIPTION
|
|
After verifying
|
|
.Ar dataset
|
|
was encrypted with
|
|
.Nm tzpfms
|
|
backend
|
|
.Sy TPM2 ,
|
|
unseals the key and loads it into
|
|
.Ar dataset .
|
|
.Pp
|
|
The user is prompted for the additional passphrase, set when creating the key, if one was set.
|
|
.Pp
|
|
See
|
|
.Xr zfs-tpm2-change-key 8
|
|
for a detailed description.
|
|
.
|
|
.Sh OPTIONS
|
|
.Bl -tag -compact -width "-n"
|
|
.It Fl n
|
|
Do a no-op/dry run, can be used even if the key is already loaded.
|
|
Equivalent to
|
|
.Nm zfs Cm load-key Ns 's
|
|
.Fl n
|
|
option.
|
|
.El
|
|
.
|
|
.\" SPDX-License-Identifier: MIT
|
|
.
|
|
.Sh ENVIRONMENT VARIABLES
|
|
.Bl -tag -compact -width "TZPFMS"
|
|
.It Ev TZPFMS_PASSPHRASE_HELPER
|
|
If set and nonempty, will be run as
|
|
.Dl Pa /bin/ Ns Nm sh Fl c Li \&"$TZPFMS_PASSPHRASE_HELPER" \&"$TZPFMS_PASSPHRASE_HELPER" Qo Ar prepared prompt Qc Qo Ar target Qc Qo Oo Li new Oc Qc Qo Oo Li again Oc Qc
|
|
to provide a passphrase, instead of reading from the standard input.
|
|
.Pp
|
|
The standard output stream of the helper is tied to an anonymous file and used in its entirety as the passphrase, except for a trailing new-line, if any.
|
|
The second argument contains either the dataset name or the element of the TPM hierarchy.
|
|
The third argument is
|
|
.Li new
|
|
if this is for a new passphrase, and the fourth is
|
|
.Li again
|
|
if it's the second prompt for that passphrase.
|
|
The first argument already contains all of this information, as a pre-formatted noun phrase.
|
|
.Pp
|
|
If the helper doesn't exist
|
|
.Pq the shell exits with Sy 127 ,
|
|
a diagnostic is issued and the normal prompt is used as fall-back.
|
|
If it fails for any other reason, the prompting is aborted.
|
|
.Pp
|
|
An example value would be:
|
|
.No ' Ns Nm systemd-ask-password Fl -id Ns Li = Ns Qo Li tzpfms:\& Ns Ar $2 Qc Qo Ar $1 Ns Li ": " Qc Ns ' .
|
|
.El
|
|
.
|
|
.\" SPDX-License-Identifier: MIT
|
|
.
|
|
.Sh TPM1.X back-end configuration
|
|
.Ss TPM selection
|
|
The
|
|
.Nm tzpfms
|
|
suite connects to a local
|
|
.Xr tcsd 8
|
|
process
|
|
.Pq at Pa localhost:30003
|
|
by default.
|
|
Use the environment variable
|
|
.Ev TZPFMS_TPM1X
|
|
to specify a remote TCS hostname.
|
|
.Pp
|
|
The TrouSerS
|
|
.Xr tcsd 8
|
|
daemon will try
|
|
.Pa /dev/tpm0 ,
|
|
then
|
|
.Pa /udev/tpm0 ,
|
|
then
|
|
.Pa /dev/tpm ;
|
|
by occupying one of the earlier ones with, for example, shell redirection, a later one can be selected.
|
|
.
|
|
.Ss See also
|
|
The TrouSerS project page at
|
|
.Lk https:/\&/sourceforge.net/projects/trousers .
|
|
.Pp
|
|
The TPM 1.2 main specification index at
|
|
.Lk https:/\&/trustedcomputinggroup.org/resource/tpm-main-specification .
|
|
.
|
|
.\" SPDX-License-Identifier: MIT
|
|
.
|
|
.Sh SPECIAL THANKS
|
|
To all who support further development, in particular:
|
|
.Bl -bullet -offset 4n -compact -width 0
|
|
.It
|
|
ThePhD
|
|
.It
|
|
Embark Studios
|
|
.It
|
|
Jasper Bekkers
|
|
.El
|
|
.
|
|
.Sh REPORTING BUGS
|
|
.Lk https:/\&/todo.sr.ht/~nabijaczleweli/tzpfms
|
|
.Pp
|
|
.Mt ~nabijaczleweli/tzpfms@lists.sr.ht ,
|
|
archived at
|
|
.Lk https:/\&/lists.sr.ht/~nabijaczleweli/tzpfms .
|
|
.
|
|
.Sh SEE ALSO
|
|
.Lk https:/\&/git.sr.ht/~nabijaczleweli/tzpfms
|