Page MenuHomeFreeBSD

bsdinstall: Stop loading cryptodev for ZFS installations
ClosedPublic

Authored by markj on May 8 2024, 3:11 PM.
Tags
None
Referenced Files
Unknown Object (File)
Dec 12 2024, 5:27 PM
Unknown Object (File)
Nov 24 2024, 6:27 PM
Unknown Object (File)
Nov 24 2024, 3:18 PM
Unknown Object (File)
Nov 24 2024, 9:52 AM
Unknown Object (File)
Nov 23 2024, 4:21 AM
Unknown Object (File)
Nov 19 2024, 9:09 PM
Unknown Object (File)
Nov 15 2024, 12:28 PM
Unknown Object (File)
Nov 8 2024, 2:05 PM
Subscribers

Details

Summary
  • zfs doesn't actually depend on cryptodev, and most arm64 kernel configs include std.dev, which includes "device crypto" anyway.
  • This config works around a problem with kldxref, not with the loader, and this is believed to be fixed.
  • Loading cryptodev creates /dev/crypto, which gives unprivileged users access to the kernel's opencrypto framework. Very few applications need it, so we're needlessly increasing the kernel's surface area.

Thus, stop auto-loading cryptodev.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 57618
Build 54506: arc lint + arc unit

Event Timeline

markj requested review of this revision.May 8 2024, 3:11 PM
This revision is now accepted and ready to land.May 8 2024, 3:16 PM

You might want to clarify the first bullet point in the commit message: the second part of the sentence seems like a non sequitur or a typo if the reader does not realize that zfs depends on crypto, which is different from cryptodev.