ZFS Trying to recover a damaged (virtual) ZROOT partition

[Cath O'Deray]

LABELS are corrupted (?)

Instead, try to get the labels from the decrypted ZFS partition (not from the disk that contains the various partitions):

zdb -l /dev/ada1p3.eli

I found a zpool labelclear command, can it help to make the pool discoverable again? …

No, probably the opposite. Did you attempt a run of the command?

… I found this code on the handbook:

# gpart bootcode -b /boot/pmbr -p /boot/gptzfsboot -i 1 ada1

Even though I am pretty sure that running random commands won't solve any issue... ?

Did you attempt to update bootcode in that way? <https://www.freebsd.org/releases/13.0R/relnotes/#boot> there's a warning to not use gpart …

 

[bsduck]

To update old ESP partitions, users should stop using the gpart(8) utility.

Why not deprecate gpart bootcode then? It's weird to keep tools in the base system that users shouldn't use anymore.

 

[freezr]

zdb -l /dev/ada1p3.eli

1) No, probably the opposite. Did you attempt a run of the command?

2) Did you attempt to update bootcode in that way?

1. No I didn't; 2. Probably I did but before stepping into the handbook...

Anyway I was able to recover some data, better than nothing...

SirDice

Even though you can use ZFS native encryption the installer is still unable to perform such operations, it still continues to use GELI.

Not sure if now you can do a full disk encryption without GELI yet...

 

[SirDice]

Even though you can use ZFS native encryption the installer is still unable to perform such operations, it still continues to use GELI.

That's correct. The installer can't use it, yet, I'm sure it'll be added in the future. Nothing's stopping you from creating it yourself though.

Not sure if now you can do a full disk encryption without GELI yet...

You can't do full disk encryption with ZFS either. You can encrypt datasets. Big difference.

OpenZFS Native Encryption - Klara Systems

Discover OpenZFS native encryption in FreeBSD 13.0. Compare it with GELI encryption and learn to create and reroot encrypted databases.

klarasystems.com

 

[freezr]

Ok... Something I got reading this article:

https://freebsdfoundation.org/wp-content/uploads/2020/07/OpenZFS-Encryption-Arrives-on-FreeBSD.pdf

1. Create your pool.
2. Create your encrypted pool.
3. Snaphost your original pool.
4. Replicate into the encrypted pool.
5. Enable the encrypted pool.
6. Destroy the old pool...

Pretty sure I won't able to make this happening! ???

 

[freezr]

That's correct. The installer can't use it, yet, I'm sure it'll be added in the future. Nothing's stopping you from creating it yourself though.


You can't do full disk encryption with ZFS either. You can encrypt datasets. Big difference.

OpenZFS Native Encryption - Klara Systems

Discover OpenZFS native encryption in FreeBSD 13.0. Compare it with GELI encryption and learn to create and reroot encrypted databases.

klarasystems.com

Your link is much better! ??

 

[Cath O'Deray]

Why not deprecate gpart bootcode then? It's weird to keep tools in the base system that users shouldn't use anymore.

It is applicable in some situations.

Not all systems have (or will have) an EFI system partition, and so on.

gpart(8)

2. Probably I did

Thanks.

I see things such as <https://www.freebsd.org/cgi/man.cgi?query=gpart&sektion=8&manpath=FreeBSD#BOOTSTRAPPING>, but I can't guess the consequences of embedding in situations where embedding is no longer appropriate.

… ZFS native encryption the installer is still unable to perform such operations, …

Yep, and the FreeBSD Foundation article mentions the non-encrypted partition that has just enough code to prompt for a passphrase, decrypt, and read a bootloader or kernel.

From last month's ZFS - GELI vs ZFS encrypted dataset:

FreeBSD bug 263171 – loader(8) and boot loader menu support for boot with OpenZFS-encrypted ROOT

– (I might need to edit the summary line of that bug report) and a postscript:

Holistically, support for OpenZFS-encrypted ROOT should be added to bsdinstall(8), however I don't imagine this happening. Gut feeling: it'll be a feature of a modernised installer (not bsdinstall).

More realistic (than bsdinstall): 263234 – Add support for OpenZFS encryption to adduser.

It's worth reading the whole of that topic (and continue there for things that are off-topic here).

 

[Cath O'Deray]

Bootcode​

FreeBSD bugs:

• 211503 – gpart bootcode should have an easier way to specify partition index
• 264090 – gpart bootcode safety checks

From the former, in 2019:

… a great way to destroy a root-on-zfs EFI system.

 

[SirDice]

Why not deprecate gpart bootcode then?

Still need it for gptzfsboot(8), gptboot(8) and MBR systems. Only for the efi boot partition should you stop using it.