zfskeys: Support autoloading of keys stored on ZFS

[0mp]

Summary

The zfskeys service script starts before the zfs service script so that
dataset decryption keys are available when zfs mount -a is run. One of
the potential edge cases of this design is that if a key is stored on
ZFS it won't be loaded until zfs mount -a is issued.

In order to address that, let's try to load the keys and mount related
ZFS datasets after the zfs script finishes its standard mounting
procedure.

PR: 262468
Reported by: Graham Perrin <[e-mail]>
Fixes: 33ff39796ffe Add zfskeys rc.d script for auto-loading encryption keys
MFC after: 3 days
Sponsored by: Modirum
Sponsored by: Klara Inc.

Test Plan

Given this Makefile:

MP1=	${.CURDIR}/1
MP2=	${MP1}/2
KEY1=	${.CURDIR}/key1
KEY2=	${MP1}/key2

DS1=	zroot/zzztmp1
DS2=	zroot/zzztmp2

all:
	echo 12345678 > ${KEY1}
	zfs create -o encryption=on -o keyformat=passphrase -o keylocation=file://${KEY1} -o mountpoint=${MP1} ${DS1}

	echo 12345678 > ${KEY2}
	zfs create -o encryption=on -o keyformat=passphrase -o keylocation=file://${KEY2} -o mountpoint=${MP2} ${DS2}

	touch ${MP2}/hi

	find ${MP1}

Run:

make all
# Run zfskeys stop twice to make sure both MP1 and MP2 are unmounted:
/etc/rc.d/zfskeys stop
/etc/rc.d/zfskeys stop
# Simulate the rc boot sequence:
/etc/rc.d/zfskeys start
/etc/rc.d/zfs start

You should observe something along the lines of:

# /etc/rc.d/zfskeys start
Loading key for zroot/zzztmp1 from file:///usr/home/0mp/zfskeys/key1..
Key file /usr/home/0mp/zfskeys/1/key2 not found, empty or unreadable. Skipping zroot/zzztmp2..

# /etc/rc.d/zfs start
Key already loaded for zroot/zzztmp1.
Loading key for zroot/zzztmp2 from file:///usr/home/0mp/klara/zfskeys/1/key2..

[ltning-freebsd_anduin.net]

libexec/rc/rc.d/zfs

50

Why do we check this? Would we even get here if it wasn't true?

[allanjude]

reviewed by: allanjude

[0mp]

libexec/rc/rc.d/zfs

50

Yes, as this is the zfs service script, not zfskeys. So this if is going to be useful when zfs is enabled and zfskeys is not.

[ltning-freebsd_anduin.net]

libexec/rc/rc.d/zfs

50

Of course, badly phrased question. Also I just realised zfskeys would complain if it was invoked but not enabled. Excuse the noise, and thank you.

[0mp]

libexec/rc/rc.d/zfs

50

Ah, yes, I avoiding complains from zfskeys is another reason. :)