system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-07-22 02:37:15 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

bsdinstall: Stop loading cryptodev for ZFS installations

Browse source 
- zfs depends on the crypto module, not cryptodev, and most arm64 kernel
  configs include std.dev, which includes "device crypto" anyway.
- This config works around a problem with kldxref lacking cross-target
  support, but that has since been fixed.
- Loading cryptodev creates /dev/crypto, which gives unprivileged users
  access to the kernel's opencrypto framework.  Very few applications
  need it, so we're needlessly increasing the kernel's surface area.

Thus, stop auto-loading cryptodev.

Reviewed by:	kevans, allanjude, des
Differential Revision:	https://reviews.freebsd.org/D45127
This commit is contained in:
Mark Johnston 2024-05-08 12:01:52 -04:00
parent 2a32b54a57
commit ffbaa453c1
1 changed files with 0 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
usr.sbin/bsdinstall/scripts/config
View file

@ -43,9 +43,6 @@ cp $BSDINSTALL_TMPETC/* $BSDINSTALL_CHROOT/etc
cat $BSDINSTALL_TMPBOOT/loader.conf.* >> $BSDINSTALL_TMPBOOT/loader.conf
rm $BSDINSTALL_TMPBOOT/loader.conf.*
# The 'cryptodev_load' line is a workaround for arm64, which does not
# automatically load cryptodev.ko with zfs.ko.
df -t zfs $BSDINSTALL_CHROOT > /dev/null && echo "cryptodev_load=\"YES\"" >> $BSDINSTALL_TMPBOOT/loader.conf
df -t zfs $BSDINSTALL_CHROOT > /dev/null && echo "zfs_load=\"YES\"" >> $BSDINSTALL_TMPBOOT/loader.conf
cp $BSDINSTALL_TMPBOOT/* $BSDINSTALL_CHROOT/boot