Page MenuHomeFreeBSD

geli: Allow disabling passphrase prompt
Needs ReviewPublic

Authored by oshogbo on May 19 2024, 1:51 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Nov 10, 5:49 PM
Unknown Object (File)
Fri, Nov 7, 2:21 AM
Unknown Object (File)
Tue, Nov 4, 2:32 AM
Unknown Object (File)
Mon, Nov 3, 6:57 AM
Unknown Object (File)
Oct 20 2025, 2:55 PM
Unknown Object (File)
Oct 20 2025, 2:55 PM
Unknown Object (File)
Oct 20 2025, 1:11 AM
Unknown Object (File)
Oct 20 2025, 1:10 AM

Details

Summary

When using mixed decryption methods, it might be useful to disable
the passphrase prompt to allow the boot process to fail gracefully.
For example, if a device is not essential for booting, it can be
ignored during the boot process. Later, we can remotely access
the machine and decrypt the device, instead of requiring a user
to connect a keyboard to the server.

I have decided to implement this as a bootloader setting rather
than a geli flag. This approach allows us to simply unset this
flag during boot in the bootloader CLI, without the need for an
additional FreeBSD box to unset the geli flag on the disk.

This change is based on: https://reviews.freebsd.org/D45250

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 57765
Build 54653: arc lint + arc unit

Event Timeline

stand/libsa/geli/geliboot.c
39

Unrelated style changes.

sys/geom/eli/g_eli.c
1259

I suspect that some valid provider names contain characters that cannot be in a kenv variable name. Do we need to handle that somehow?

1262

Just a suggestion, plain "Skip" is too unclear IMO.