⭐ Football Update: openzfs/zfs/pull/

allanjude · 2025-07-15T19:36:45Z

Motivation and Context

Allow delegation of permission to ONLY send raw encrypted replication.
This allows automated replication processes to only have permission to the raw replication stream, without the ability to send the decrypted version of the stream.

Description

A new zfs allow permission: send:encrypted, similar to the existing send permission, but only allows send with the --raw flag. Any attempt to send without --raw will be denied.
The existing send permission is unchanged, so retains the ability to send either way.

How Has This Been Tested?

Manually, and with new ZTS additions

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Performance enhancement (non-breaking change which improves efficiency)
Code cleanup (non-breaking change which makes code smaller or more readable)
Quality assurance (non-breaking change which makes the code more robust against bugs)
Breaking change (fix or feature that would cause existing functionality to change)
Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
Documentation (a change to man pages or other documentation)

Checklist:

My code follows the OpenZFS code style requirements.
I have updated the documentation accordingly.
I have read the contributing document.
I have added tests to cover my changes.
I have run the ZFS Test Suite with this change applied.
All commit messages are properly formatted and contain Signed-off-by.

snajpa · 2025-07-17T16:11:49Z

Why can't it be send:raw, when it is in fact about just that? Raw by far doesn't imply encrypted.

amotin · 2025-07-17T16:17:56Z

Why can't it be send:raw, when it is in fact about just that? Raw by far doesn't imply encrypted.

Outside of encryption it makes no sense to restrict it. But I agree that raw sounds consistent with the zfs send terminology.

allanjude · 2025-07-17T17:39:08Z

Why can't it be send:raw, when it is in fact about just that? Raw by far doesn't imply encrypted.

The permission was originally called sendraw and we changed it to have the : etc and match what other had done with receive: append etc.

If there is a preference to call it send:raw that is fine with us, we'll do the search/replace with the next push to solve the other issues.

allanjude · 2025-07-21T15:17:43Z

Fixed a missing line continuation that failed to install some of the tests

behlendorf

Functionally things look good after fixing up the tests.

behlendorf · 2025-08-29T00:22:25Z

I'd love to see this wrapped up so we can pull it in for the final 2.4.

A new `zfs allow` permissions that ONLY allows sending replication streams in raw (encrypted) mode, so encrypted data will not be decrypted as part of the replication process. Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Co-authored-by: JT Pennington <jt.pennington@klarasystems.com> Signed-off-by: Allan Jude <allan@klarasystems.com>

Create tests for the new send:encrypted permission Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Signed-off-by: JT Pennington <jt.pennington@klarasystems.com>

allanjude · 2025-09-11T22:23:39Z

Requested changes applied

behlendorf

Thanks, that looks like it'll do the trick.

Create tests for the new send:encrypted permission Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Signed-off-by: JT Pennington <jt.pennington@klarasystems.com> Closes #17543

A new `zfs allow` permissions that ONLY allows sending replication streams in raw (encrypted) mode, so encrypted data will not be decrypted as part of the replication process. Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Co-authored-by: JT Pennington <jt.pennington@klarasystems.com> Signed-off-by: Allan Jude <allan@klarasystems.com> Closes openzfs#17543

Create tests for the new send:encrypted permission Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Signed-off-by: JT Pennington <jt.pennington@klarasystems.com> Closes openzfs#17543

A new `zfs allow` permissions that ONLY allows sending replication streams in raw (encrypted) mode, so encrypted data will not be decrypted as part of the replication process. Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Co-authored-by: JT Pennington <jt.pennington@klarasystems.com> Signed-off-by: Allan Jude <allan@klarasystems.com> Closes openzfs#17543

Create tests for the new send:encrypted permission Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Signed-off-by: JT Pennington <jt.pennington@klarasystems.com> Closes openzfs#17543

When performing an incremental raw send (-w -I), the kernel was incorrectly requiring the standard 'send' permission instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send(). This change relaxes the comparison to a standard truthy check and updates the test suite to properly verify delegated raw send behavior. Fixes: openzfs#18193 Introduced-by: openzfs#17543 Signed-off-by: Marc Sladek <marc@sladek.dev>

When performing an incremental raw send with intermediates (-w -I), the kernel was incorrectly requiring the standard 'send' permission instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send(). This change relaxes the comparison to a standard truthy check and updates the test suite to properly verify delegated raw send behavior. Fixes: openzfs#18193 Introduced-by: openzfs#17543 Signed-off-by: Marc Sladek <marc@sladek.dev>

When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Fixes: openzfs#18193 Introduced-by: openzfs#17543 Signed-off-by: Marc Sladek <marc@sladek.dev>

When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Introduced-by: #17543 Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Marc Sladek <marc@sladek.dev> Closes #18198 Closes #18193

When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Introduced-by: openzfs#17543 Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Marc Sladek <marc@sladek.dev> Closes openzfs#18198 Closes openzfs#18193

A new `zfs allow` permissions that ONLY allows sending replication streams in raw (encrypted) mode, so encrypted data will not be decrypted as part of the replication process. Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Co-authored-by: JT Pennington <jt.pennington@klarasystems.com> Signed-off-by: Allan Jude <allan@klarasystems.com> Closes openzfs#17543

Create tests for the new send:encrypted permission Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Signed-off-by: JT Pennington <jt.pennington@klarasystems.com> Closes openzfs#17543

When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Introduced-by: openzfs#17543 Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Marc Sladek <marc@sladek.dev> Closes openzfs#18198 Closes openzfs#18193

When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Introduced-by: openzfs/zfs#17543 Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Marc Sladek <marc@sladek.dev> Closes #18198 Closes #18193

When performing an incremental raw send with intermediates (-w -I), the standard 'send' permission was incorrectly required instead of allowing 'send:raw'. This was due to a strict boolean comparison on the 'rawok' flag in zfs_secpolicy_send() with non-boolean value. This change normalizes the 'rawok' variable to be strictly 0/1 and updates the test suite to properly verify delegated raw send behavior. Introduced-by: openzfs#17543 Reviewed-by: Alexander Motin <alexander.motin@TrueNAS.com> Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Signed-off-by: Marc Sladek <marc@sladek.dev> Closes openzfs#18198 Closes openzfs#18193

amotin reviewed Jul 15, 2025

View reviewed changes

Comment thread man/man8/zfs-allow.8 Resolved

allanjude force-pushed the send_encrypted branch from 8bfcda6 to 97fbdcb Compare July 17, 2025 18:28

behlendorf added the Status: Code Review Needed Ready for review and testing label Jul 18, 2025

allanjude force-pushed the send_encrypted branch from 97fbdcb to a027152 Compare July 21, 2025 15:17

amotin reviewed Jul 21, 2025

View reviewed changes

behlendorf added the Status: Revision Needed Changes are required for the PR to be accepted label Aug 6, 2025

allanjude force-pushed the send_encrypted branch from a027152 to 9ecc9bb Compare August 14, 2025 17:40

github-actions Bot removed the Status: Revision Needed Changes are required for the PR to be accepted label Aug 14, 2025

amotin approved these changes Aug 14, 2025

View reviewed changes

behlendorf approved these changes Aug 14, 2025

View reviewed changes

behlendorf mentioned this pull request Aug 23, 2025

Add the send-raw permission #14322

Closed

6 of 13 tasks

behlendorf reviewed Aug 23, 2025

View reviewed changes

Comment thread cmd/zfs/zfs_main.c Resolved

Comment thread include/sys/dsl_deleg.h Resolved

behlendorf added the Status: Revision Needed Changes are required for the PR to be accepted label Aug 23, 2025

allanjude force-pushed the send_encrypted branch from 9ecc9bb to 9f83a54 Compare September 8, 2025 14:59

github-actions Bot removed the Status: Revision Needed Changes are required for the PR to be accepted label Sep 8, 2025

allanjude force-pushed the send_encrypted branch from 9f83a54 to 8be2760 Compare September 9, 2025 20:53

amotin changed the title ~~zfs allow send:encrypted~~ zfs allow send:raw Sep 10, 2025

behlendorf requested changes Sep 10, 2025

View reviewed changes

Comment thread tests/zfs-tests/tests/functional/cli_root/zfs_send_delegation/setup.ksh Resolved

behlendorf added the Status: Revision Needed Changes are required for the PR to be accepted label Sep 10, 2025

allanjude and others added 2 commits September 11, 2025 22:23

Add send:encrypted test

35a69f1

Create tests for the new send:encrypted permission Sponsored-by: Klara, Inc. Sponsored-by: Karakun AG Signed-off-by: JT Pennington <jt.pennington@klarasystems.com>

allanjude force-pushed the send_encrypted branch from 8be2760 to 35a69f1 Compare September 11, 2025 22:23

github-actions Bot removed the Status: Revision Needed Changes are required for the PR to be accepted label Sep 11, 2025

behlendorf approved these changes Sep 11, 2025

View reviewed changes

behlendorf added Status: Accepted Ready to integrate (reviewed, tested) and removed Status: Code Review Needed Ready for review and testing labels Sep 11, 2025

amotin approved these changes Sep 12, 2025

View reviewed changes

behlendorf closed this in 7b1cc9e Sep 12, 2025

msladek mentioned this pull request Oct 1, 2025

Feature: zfs allow send-raw for raw/encrypted sends only #13099

Closed

msladek mentioned this pull request Feb 10, 2026

2.4.0 send:raw permission fails on incremental send with intermediates (-I) #18193

Closed

msladek mentioned this pull request Feb 11, 2026

Fix send:raw permission for send -w -I #18198

Merged

6 of 14 tasks

Navigation Menu

Repository navigation

zfs allow send:raw - #17543

zfs allow send:raw#17543
allanjude wants to merge 2 commits into
openzfs:masterfrom
KlaraSystems:send_encrypted

allanjude commented Jul 15, 2025

Uh oh!

Uh oh!

snajpa commented Jul 17, 2025

Uh oh!

amotin commented Jul 17, 2025

Uh oh!

allanjude commented Jul 17, 2025

Uh oh!

allanjude commented Jul 21, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

behlendorf left a comment

Uh oh!

Uh oh!

Uh oh!

behlendorf commented Aug 29, 2025

Uh oh!

Uh oh!

allanjude commented Sep 11, 2025

Uh oh!

behlendorf left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

allanjude commented Jul 15, 2025

Motivation and Context

Description

How Has This Been Tested?

Types of changes

Checklist:

Uh oh!

Uh oh!

snajpa commented Jul 17, 2025

Uh oh!

amotin commented Jul 17, 2025

Uh oh!

allanjude commented Jul 17, 2025

Uh oh!

allanjude commented Jul 21, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

behlendorf left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

behlendorf commented Aug 29, 2025

Uh oh!

Uh oh!

allanjude commented Sep 11, 2025

Uh oh!

behlendorf left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants