Mounting encrypted ZFS datasets/GELI for users?

[Eric McCorkle]

I'm presently looking into options presented by ZFS encryption.  One
idea I had was something like this (I'm going to go with ZFS for now,
but you could presumably do something like this with GELI, with more
effort).

You could have your users' home directories on separate ZFS datasets,
with a separate encryption key generated from their passphrase (you
could also generalize this to a session key generated from some other
form of authentication).  When a user logs in, their authentication
materials are used to recover the ZFS key, which is then used to mount
the home directory.  When they log out, their home directory is unmounted.

The tricky part seems to be that you need their authentication
materials.  I think you could maybe accomplish something like this with
a custom PAM module that would load the key when the user logs in.  I'm
less sure how to unload the key when they log out, though.  If you could
manage that, then I think standard automounter stuff should be able to
handle mounting and unmounting the actual filesystem as needed.

Does anyone know of a better way to go about doing this?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-hackers/attachments/20201005/f9961ecd/attachment.sig>