From nobody Mon Aug 24 18:49:04 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTKh04XmHz6plNC for ; Mon, 24 Aug 2026 18:49:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTKh02qGdz3Wp3 for ; Mon, 24 Aug 2026 18:49:04 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787597344; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eDqScZIfe4qbOUMwLBsOBjVAL1ouy+7f5yCwYk0sT1Q=; b=wnSNZqXVJ65vAdvkwTo1J81fJBOtBUWOOQCeJTD0zMTePnDxpn2ORDwD+xzw8F8jmrbT8J Y7eSdSvu/tvOwPfbgazHgGjMqr8ueZ+tLjkyLfLnCbdu/fyljmXSZrRMAQ4cJ+QaSf4jZG sFw1iorjA0lCLqvuDrGBvmWYzmEgjceNOrhQ+Nd0wOx5IjAHJLcF4HIOuxjs1y2sy1Pey9 RpU4eP5MRPkwlcteQzHwNhC2e6MYnPyz5mb+wOhU8V69HOQ+bNg5t1tWhZmTfYafG9WNfp VpFNY9ZFYEuWHGiQ/5T9NO9iNBEL+MmqBcZmgVtOk6zvQwAKQVFT4fwIN+Y4zg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787597344; a=rsa-sha256; cv=none; b=PjlqQ67tQF3Ikxf+awOwPgt2hHV/ZMJiCB17IR6WSy/z1GBXwfYulra6x1NovH8yz9ZXU6 /jsFTHV5JF9455LaNk3b7Gg4B1YXj2BRfpuAAbCtzzq6s8Q4pFA+tN9MnzacrJQNYb59Dn eSDT6KcHxRhnAoY1qZPthvUD9giNELzUPuNzghcpSXniouLWSglHMCUrangPPmW/HjsvOH ymDn8OQbojOLKUmM9QBwdJj2KQpzYWvEoQVEZ0t517fL6r+L7qTOYZImfE2eRUOJLef4ZJ E3RdOQjeAhd7qGFyvNvYN+//nbJBH3OltJ8QDBBXbBIvICnt83huG8d9p9q/cw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787597344; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eDqScZIfe4qbOUMwLBsOBjVAL1ouy+7f5yCwYk0sT1Q=; b=AxR+WfHGH3ksUknvrqHPP54vOpDKOUmw/eeitTVP82EyvoaQhPqH+Kaf45Uti0wtIkeIsv mBu27mT7LgF7CVVNi9pSDtcG66v8sgy4Lw60nyTmOPUfbLArgYwGteW65Lhvd5q7QwBCVs 78Cs2et5xm7b5YT7C4tCM0JVwCVu7BOgr6ogkFflHzWo1tuEBVqWQE+xs5xRroUB9DmKMX BabvXizr8l+fYAPGsB13Ib52mpIVj7a0QLvFF5S1l/d697p/mWG2JMZ9h4aVAuBZKNnwXz XkWYa5xNQosLnmPhVCkK8qEu+Bc6fD9Hp2SUC3khfZRscXbiBDJH/v5Xiu/5dg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTKh00JqQz2JP for ; Mon, 24 Aug 2026 18:49:04 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3777d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 24 Aug 2026 18:49:04 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Doug Ambrisko Subject: git: 3f73758036c7 - stable/15 - zfskeys - only prompt if zfskeys and zfskeys_prompt are enabled List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ambrisko X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 3f73758036c7be2572d73bb72914801db06f5f4f Auto-Submitted: auto-generated Date: Mon, 24 Aug 2026 18:49:04 +0000 Message-Id: <6a8c9220.3777d.19f1e533@gitrepo.freebsd.org> The branch stable/15 has been updated by ambrisko: URL: https://cgit.FreeBSD.org/src/commit/?id=3f73758036c7be2572d73bb72914801db06f5f4f commit 3f73758036c7be2572d73bb72914801db06f5f4f Author: Doug Ambrisko AuthorDate: 2026-06-22 18:45:42 +0000 Commit: Doug Ambrisko CommitDate: 2026-08-24 18:48:45 +0000 zfskeys - only prompt if zfskeys and zfskeys_prompt are enabled By default don't block booting with a prompt if a zpool needs a keyboard password to unlock it. To enable prompting for keyboard password during boot require: zfskeys_enable="YES" zfskeys_prompt_enable="YES" to both be enabled. This returns to POLA of prior behaviour. PR: 296130 Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D57750 (cherry picked from commit 276a3dacdb60b65d65301aced5d8443cc5d27ea2) --- libexec/rc/rc.conf | 1 + libexec/rc/rc.d/zfskeys | 16 +++++++++------- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/libexec/rc/rc.conf b/libexec/rc/rc.conf index 7fe5ffcd96cf..ba61bd43a37a 100644 --- a/libexec/rc/rc.conf +++ b/libexec/rc/rc.conf @@ -77,6 +77,7 @@ rc_conf_files="/etc/rc.conf /etc/rc.conf.local" # ZFS support zfs_enable="NO" # Set to YES to automatically mount ZFS file systems zfskeys_enable="NO" # Set YES to autoload ZFS encryption keys +zfskeys_prompt_enable="NO" # Set YES to prompt during booting zfs_bootonce_activate="NO" # Set YES to make successful bootonce BE permanent zpool_reguid="" # Set to zpools for which the GUID should be replaced # upon first boot. diff --git a/libexec/rc/rc.d/zfskeys b/libexec/rc/rc.d/zfskeys index aff0224d5c9d..af47f8737c13 100755 --- a/libexec/rc/rc.d/zfskeys +++ b/libexec/rc/rc.d/zfskeys @@ -20,6 +20,7 @@ required_modules="zfs" : ${zfskeys_datasets:=''} : ${zfskeys_timeout:=10} : ${zfskeys_unload_force:='NO'} +: ${zfskeys_prompt_enable:='NO'} encode_args() { @@ -45,13 +46,14 @@ unlock_fs() local kl="$2" local k="${kl##file://}" - if [ "$kl" == "prompt" ] - then - echo "Key prompt for $fs." - if zfs load-key -L "$kl" "$fs" < /dev/tty > /dev/tty 2>/dev/tty ; then - echo "Key loaded for $fs." - else - echo "Key failed to load for $fs." + if [ "$kl" == "prompt" ]; then + if checkyesno zfskeys_prompt_enable ; then + echo "Key prompt for $fs." + if zfs load-key -L "$kl" "$fs" < /dev/tty > /dev/tty 2>/dev/tty ; then + echo "Key loaded for $fs." + else + echo "Key failed to load for $fs." + fi fi elif [ "$k" ] && [ -f "$k" ] && [ -s "$k" ] && [ -r "$k" ]; then if [ "$(zfs get -Ho value keystatus "$fs")" = 'available' ]; then