ZFS snapshots and daily security checks

[Johannes Totz]

On 08/04/2013 08:42, Lev Serebryakov wrote:
> Hello, Jeremy.
> You wrote 8 апреля 2013 г., 4:54:38:
>
>>>    Is it possible to exclude these snapshots from `mount -p' output or
>>> don't mount them to hierarchy by default?
> JC> Taken from my stable/9 r249160 system:
>    And  here  is  my  9.1-STABLE  r244958 (I'm filtering out all hourly
>    output, or this message will be infinite):
>
> % df -k
> Filesystem            1024-blocks     Used     Avail Capacity  Mounted on
> /dev/mirror/root          2026028   675598   1188348    36%    /
> devfs                           1        1         0   100%    /dev
> fdescfs                         1        1         0   100%    /dev/fd
> procfs                          4        4         0   100%    /proc
> /dev/mirror/var          16244332  6285320   8659466    42%    /var
> /dev/mirror/tmp           1012972    12290    919646     1%    /tmp
> /dev/mirror/usr          64995336 10259340  49536370    17%    /usr
> /dev/mirror/databases   101554148   174252  93255566     0%    /var/databases
> pool                    487184219       21 487184198     0%    /pool
> pool/home               511417117 24232919 487184198     5%    /usr/home
> devfs                           1        1         0   100%    /var/named/dev
> % mount
> /dev/mirror/root on / (ufs, local)
> devfs on /dev (devfs, local)
> fdescfs on /dev/fd (fdescfs)
> procfs on /proc (procfs, local)
> /dev/mirror/var on /var (ufs, local, soft-updates)
> /dev/mirror/tmp on /tmp (ufs, local, soft-updates)
> /dev/mirror/usr on /usr (ufs, local, soft-updates)
> /dev/mirror/databases on /var/databases (ufs, local, soft-updates)
> pool on /pool (zfs, local, nfsv4acls)
> pool/home on /usr/home (zfs, local, nfsv4acls)
> devfs on /var/named/dev (devfs, local)
> % zfs list -t snapshot | grep -v hourly
> NAME                                       USED  AVAIL  REFER  MOUNTPOINT
> pool/home at daily-2013-04-05_03.01.28--1m    544K      -  23.1G  -
> pool/home at daily-2013-04-06_03.01.20--1m    688K      -  23.1G  -
> pool/home at weekly-2013-04-06_04.15.34--1y  1.70M      -  23.1G  -
> pool/home at daily-2013-04-07_03.04.44--1m   1.15M      -  23.1G  -
> pool/home at daily-2013-04-08_03.01.31--1m    437K      -  23.1G  -
> % mount -p | grep -v hourly
> /dev/mirror/root        /                       ufs     rw              1 1
> devfs                   /dev                    devfs   rw              0 0
> fdescfs                 /dev/fd                 fdescfs rw              0 0
> procfs                  /proc                   procfs  rw              0 0
> /dev/mirror/var         /var                    ufs     rw              2 2
> /dev/mirror/tmp         /tmp                    ufs     rw              2 2
> /dev/mirror/usr         /usr                    ufs     rw              2 2
> /dev/mirror/databases   /var/databases          ufs     rw              3 3
> pool                    /pool                   zfs     rw,nfsv4acls    0 0
> pool/home               /usr/home               zfs     rw,nfsv4acls    0 0
> devfs                   /var/named/dev          devfs   rw              0 0
> pool/home at daily-2013-04-05_03.01.28--1m /usr/home/.zfs/snapshot/daily-2013-04-05_03.01.28--1m zfs       ro,nosuid,noatime,nfsv4acls     0 0
> pool/home at daily-2013-04-06_03.01.20--1m /usr/home/.zfs/snapshot/daily-2013-04-06_03.01.20--1m zfs       ro,nosuid,noatime,nfsv4acls     0 0
> pool/home at weekly-2013-04-06_04.15.34--1y /usr/home/.zfs/snapshot/weekly-2013-04-06_04.15.34--1y zfs     ro,nosuid,noatime,nfsv4acls     0 0
> pool/home at daily-2013-04-07_03.04.44--1m /usr/home/.zfs/snapshot/daily-2013-04-07_03.04.44--1m zfs       ro,nosuid,noatime,nfsv4acls     0 0
> %
>
> JC> It seems to me mount and mount -p show the mounted snapshot.
>   I didn't mount snapshot specifically, and they are created by zfSnap
> script from ports (sysutils/zfsnap).
>   As I can see in this script, snapshots are created with
>
>   /sbin/zfs snapshot -r ${fs}@${snapshot}
>

Are your snapshots set to visible?
zpool get listsnapshots pool

If I remember correctly, daily security uses find to walk the file 
system tree...