The zroot/home/xxx data set must be mounted.
Example, loading key and mounting data set together (as root or with root privileges as user) :
zfs mount -l zroot/home/xxx
It seems automatic created ZFS encrypted user home data sets are in a experimental state for now.
>14.1
adduser(8) provides an option to create them, but the user can not mount the <pool>/home/<user> data set without elevated privileges (
su(1),
security/sudo,
security/doas,
security/super).
The user is provided with ZFS delegated "mount" permission, but when executed
zfs-mount(8), permission is denied.
/usr/sbin/adduser
Rich (BB code):
691 # set_zfs_perms
692 # Give new user ownership of newly created zfs dataset.
693 #
694 set_zfs_perms() {
695 if ! ${ZFSCMD} allow "${username}" create,destroy,mount,snapshot "${zhome}"; then
696 err "There was an error setting permissions on ZFS dataset (${zhome})."
697 return 1
698 fi
699 }
Rich (BB code):
# zfs allow zroot/home/xxx
---- Permissions on zroot/home/xxx ----------------------------------
Local+Descendent permissions:
user xxx create,destroy,mount,snapshot
I haven't figured out why
zfs-mount(8) returns insufficient privileges (
zfs mount -l zroot/home/<user>).
The user is in the "operator" group and
vfs.usermount=1.
Furthermore, to load and unload password key, the "load-key" permission is not set. See
zfs-allow(8) for details.
The "load-key" permission can be set manually, but it doesn't do any good with the "mount" permission denied, even though it's set.
Next obstacle: Decrypt and mount <pool>/home/<user> data set with the user name when login.
To configure, a pam modul must be set manually, see
https://forums.freebsd.org/threads/...irectory-decrypted-at-login.86819/post-585115, and it has some drawbacks, see in "Not working".
As I said, the whole concept looks experimental.
