When you make any change on a zfs dataset, changes are not applied to already existant data. So, if you find a ZFS dataset that says it has encyption ON, there is a way to check if an individual file has its data really encrypted or not?
3 Answers
To be honest, I am not sure, if this is reliable, but it might give a hin in the prudent direction: query the key date versus the file modification date and compare the values.
#zfs get rekeydate <pool>/<dataset> NAME PROPERTY VALUE SOURCE <pool>/<dataset> rekeydate Tue Dec 15 15:43 2022 local That would be the date of the last keychange - and should therefore match the first encryption if you never changed it before. Compare this against stat file (modification time).
- Being ZFS a CoW FS, this not ensures you that the file contents are in fact fully encrypted, specifically it would be a problem for file sizes bigger than dataset recordsize. I suppose there is no real way to track all the chunks of a file and individually check if they have been encrypted or not.Héctor– Héctor2023-10-03 06:21:01 +00:00Commented Oct 3, 2023 at 6:21
When you make any change on a zfs dataset, changes are not applied to already existant data.
This is true for changeable properties like turning on compression or changing the compression method, but encryption can be activated only when the filesystem is created, and cannot be de-activated. As such, encryption is never a "change" to the dataset. It has to be enabled before the data is written to the dataset.
Therefore, one can be assured that any data written to an encrypted dataset is indeed encrypted.
On newer ZFS versions, you don't actually encrypt the whole disk, but the datasets. In these cases, you need to check the actual pool or dataset:
zfs get all mypool | egrep "encryption|key" Should output something alike
mypool encryption aes-256-gcm - mypool keylocation file:///root/.zfs-encrypt.key local mypool keyformat raw - mypool encryptionroot estor - mypool keystatus unavailable - Showing the encryption algorithm aes-256-gcm should be enough.
You could still use zfs unload-keys to check if you loose access to the files, making sure they're encrypted.
ATTENTION: Using zfs native encryption only encrypts current dataset, even if standard inherited behavior will encrypt child datasets, it will not encrypt zfs receive datasets unless explicitly activated.
