Re: GELI zfs encryption removal

On Wed, Feb 14, 2024 at 11:09 PM void <void@f-m.fm> wrote:

> Hi,
>
> I'd like to remove GELI encryption. It was installed
> when the OS was installed; the option to encrypt data was
> chosen when auto-zfs was selected.
>
> At the moment, when it reboots, it prompts for the GELI
> passphrase, which I have to enter from the console[1], and it
> then boots normally. [1] is a nuisance to access, so I'd like to
> (safely) remove it. Is this possible, without having to transfer
> all the data out, reformat, then transfer it all back in again?
>
>
Hi

It should be possible in theory, but some development would be needed
before you could do it in practice.

On Linux there is the FIBMAP ioctl, which can tell the caller the offset on
the filesystem's block device for a given file block (or some special value
if the block is sparse). There are tools like convertfs and fstransform
[1], which can reformat the block device to a different filesystem
in-place. They start by (1) creating a sparse file as large as the block
device, (2) loop-mounting and formatting that sparse file with the new
filesystem, (3) moving all the files from the underlying filesystem into
this new filesystem. At that point, the old filesystem has a single large
file, containing the new filesystem and all the files. Every block in that
file is then scanned with the FIBMAP ioctl to discover where on the block
device it lies. Finally, the blocks are moved around, so each is in the
right place for the block device to contain the new filesystem.

Now if FreeBSD has a similar ioctl (when last I checked it didn't), a
similar process could be used to permanently decrypt a GELI block device.
The block rearrangement step at the end would need to read blocks from
GELI, but write them to the GEOM provider under GELI. Also GELI uses cipher
block chaining, which means blocks relate to some of their adjacent blocks,
and cannot be overwritten individually without corrupting the others, so
such a tool would have to move blocks around very carefully.

[1] https://sourceforge.net/projects/fstransform