Hacker News new | ask | show | jobs
by mrsteveman1 3624 days ago
Which means you can also potentially use different keys for each encrypted filesystem as well, one for each user or various other scenarios
1 comments

That’s interesting, but it again seems like something which can be implemented independently of the particular choice of file system.
Only sort of?

ZFS is both filesystem and logical volume abstraction, so to implement different keys on different "filesystems" on ZFS, you'd need to expose them as block devices, not filesystems, and then use your encryption du jour on them, then your filesystem atop that - which also kills most of your compression or encryption properties, since you're doing it before ZFS sees the data, so to speak.

I guess I was thinking more like a 9P[0] approach where a file system can be given to a module (or any program) and based on it the module can export a related file system. For example the module would encrypt the files before storing it to the given file system.

However, I realise this does not quite fit into the current kernel architectures.

[0] https://en.wikipedia.org/wiki/9P_(protocol)