Re:The Birth of ZFS [video]
by belovedeagle on Sunday November 15, 2015 @06:40AM
(#10569331)
There are major benefits to be had from moving the encryption layer on top of the volume management/storage EDAC layers which ZFS provides: in particular, it'd be nice to be able to scrub a locked dataset. I think (but haven't seen this firsthand) that Oracle's implementation offers that benefit.
[ Parent
| on HN ]
You can still scrub a dataset with GELI (https://www.freebsd.org/cgi/man.cgi?geli%288%29)
GELI creates a virtual block device that works great with ZFS, you get it all, self-healing, checksumming etc.
Re:The Birth of ZFS [video]
by belovedeagle on Sunday November 15, 2015 @06:09PM
(#10571665)
It looks like GELI goes below zfs just like dm-crypt. That doesn't allow you to scrub a locked dataset (one where the key is not in memory, possibly unknown). You could use zvols, of course, but that loses some (but not all) of the full-stack zfs benefits.
No, you create virtual block devices that needs to be "unlocked" before you can start using ZFS. If you need to scrub the dataset, you need to unlock all the virtual block devices, start ZFS and then run the scrub command.
The whole point is to run ZFS on top of virtual block devices which are encrypted with GELI and "unlocked".