zfs

title: zfs(8)

summary: configure ZFS datasets

text:
# zfs(8)

## NAME
zfs — configure ZFS datasets

## SYNOPSIS
zfs

-?V

zfs

version [-j]

zfs

subcommand [arguments]

## DESCRIPTION
The zfs command configures ZFS datasets within a ZFS storage pool, as described in zpool(8). A dataset is identified by a unique path within the ZFS namespace:

pool[/component]/component

for example:

rpool/var/log

The maximum length of a dataset name is ZFS_MAX_DATASET_NAME_LEN - 1 ASCII characters (currently 255) satisfying [A-Za-z_.:/ -]. Additionally snapshots are allowed to contain a single @ character, while bookmarks are allowed to contain a single # character. / is used as separator between components. The maximum amount of nesting allowed in a path is zfs_max_dataset_nesting levels deep. ZFS tunables (zfs_*) are explained in zfs(4).

A dataset can be one of the following:

file system

Can be mounted within the standard system namespace and behaves like other file systems. While ZFS file systems are designed to be POSIX-compliant, known issues exist that prevent compliance in some cases. Applications that depend on standards conformance might fail due to non-standard behavior when checking file system free space.

volume

A logical volume exported as a raw or block device. This type of dataset should only be used when a block device is required. File systems are typically used in most environments.

snapshot

A read-only version of a file system or volume at a given point in time. It is specified as filesystem@name or volume@name.

bookmark

Much like a snapshot, but without the hold on on-disk data. It can be used as the source of a send (but not for a receive). It is specified as filesystem#name or volume#name.

See zfsconcepts(7) for details.

### Properties
Properties are divided into two types: native properties and user-defined (or "user") properties. Native properties either export internal statistics or control ZFS behavior. In addition, native properties are either editable or read-only. User properties have no effect on ZFS behavior, but you can use them to annotate datasets in a way that is meaningful in your environment. For more information about properties, see zfsprops(7).

### Encryption
Enabling the encryption feature allows for the creation of encrypted filesystems and volumes. ZFS will encrypt file and zvol data, file attributes, ACLs, permission bits, directory listings, FUID mappings, and userused/groupused/projectused data. For an overview of encryption, see zfs-load-key(8).

## SUBCOMMANDS
All subcommands that modify state are logged persistently to the pool in their original form.

zfs -?

Displays a help message.

zfs -V, --version

zfs version [-j]

Displays the software version of the zfs userland utility and the zfs kernel module. Use -j option to output in JSON format.

### Dataset Management
zfs-list(8)

Lists the property information for the given datasets in tabular form.

zfs-create(8)

Creates a new ZFS file system or volume.

zfs-destroy(8)

Destroys the given dataset(s), snapshot(s), or bookmark.

zfs-rename(8)

Renames the given dataset (filesystem or snapshot).

zfs-upgrade(8)

Manage upgrading the on-disk version of filesystems.

### Snapshots
zfs-snapshot(8)

Creates snapshots with the given names.

zfs-rollback(8)

Roll back the given dataset to a previous snapshot.

zfs-hold(8)/zfs-release(8)

Add or remove a hold reference to the specified snapshot or snapshots. If a hold exists on a snapshot, attempts to destroy that snapshot by using the zfs destroy command return EBUSY.

zfs-diff(8)

Display the difference between a snapshot of a given filesystem and another snapshot of that filesystem from a later time or the current contents of the filesystem.

### Clones
zfs-clone(8)

Creates a clone of the given snapshot.

zfs-promote(8)

Promotes a clone file system to no longer be dependent on its "origin" snapshot.

### Send & Receive
zfs-send(8)

Generate a send stream, which may be of a filesystem, and may be incremental from a bookmark.

zfs-receive(8)

Creates a snapshot whose contents are as specified in the stream provided on standard input. If a full stream is received, then a new file system is created as well. Streams are created using the zfs-send(8) subcommand, which by default creates a full stream.

zfs-bookmark(8)

Creates a new bookmark of the given snapshot or bookmark. Bookmarks mark the point in time when the snapshot was created, and can be used as the incremental source for a zfs send command.

zfs-redact(8)

Generate a new redaction bookmark. This feature can be used to allow clones of a filesystem to be made available on a remote system, in the case where their parent need not (or needs to not) be usable.

### Properties
zfs-get(8)

Displays properties for the given datasets.

zfs-set(8)

Sets the property or list of properties to the given value(s) for each dataset.

zfs-inherit(8)

Clears the specified property, causing it to be inherited from an ancestor, restored to default if no ancestor has the property set, or with the -S option reverted to the received value if one exists.

### Quotas
zfs-userspace(8)/zfs-groupspace(8)/zfs-projectspace(8)

Displays space consumed by, and quotas on, each user, group, or project in the specified filesystem or snapshot.

zfs-project(8)

List, set, or clear project ID and/or inherit flag on the files or directories.

### Mountpoints
zfs-mount(8)

Displays all ZFS file systems currently mounted, or mount ZFS filesystem on a path described by its mountpoint property.

zfs-unmount(8)

Unmounts currently mounted ZFS file systems.

### Shares
zfs-share(8)

Shares available ZFS file systems.

zfs-unshare(8)

Unshares currently shared ZFS file systems.

### Delegated Administration
zfs-allow(8)

Delegate permissions on the specified filesystem or volume.

zfs-unallow(8)

Remove delegated permissions on the specified filesystem or volume.

### Encryption
zfs-change-key(8)

Add or change an encryption key on the specified dataset.

zfs-load-key(8)

Load the key for the specified encrypted dataset, enabling access.

zfs-unload-key(8)

Unload a key for the specified dataset, removing the ability to access the dataset.

### Channel Programs
zfs-program(8)

Execute ZFS administrative operations programmatically via a Lua script-language channel program.

### Data rewrite
zfs-rewrite(8)

Rewrite specified files without modification.

### Jails
zfs-jail(8)

Attaches a filesystem to a jail.

zfs-unjail(8)

Detaches a filesystem from a jail.

### Waiting
zfs-wait(8)

Wait for background activity in a filesystem to complete.

## EXIT STATUS
The zfs utility exits 0 on success, 1 if an error occurs, and 2 if invalid command line options were specified.

## EXAMPLES

### Example 1: Creating a ZFS File System Hierarchy
The following commands create a file system named pool/home and a file system named pool/home/bob. The mount point /export/home is set for the parent file system, and is automatically inherited by the child file system.

\# zfs create pool/home

\# zfs set mountpoint=/export/home pool/home

\# zfs create pool/home/bob

### Example 2: Creating a ZFS Snapshot
The following command creates a snapshot named yesterday. This snapshot is mounted on demand in the .zfs/snapshot directory at the root of the pool/home/bob file system.

\# zfs snapshot pool/home/bob@yesterday

### Example 3: Creating and Destroying Multiple Snapshots
The following command creates snapshots named yesterday of pool/home and all of its descendent file systems. Each snapshot is mounted on demand in the .zfs/snapshot directory at the root of its file system. The second command destroys the newly created snapshots.

\# zfs snapshot -r pool/home@yesterday

\# zfs destroy -r pool/home@yesterday

### Example 4: Disabling and Enabling File System Compression
The following command disables the compression property for all file systems under pool/home. The next command explicitly enables compression for pool/home/anne.

\# zfs set compression=off pool/home

\# zfs set compression=on pool/home/anne

### Example 5: Listing ZFS Datasets
The following command lists all active file systems and volumes in the system. Snapshots are displayed if listsnaps=on. The default is off. See zpoolprops(7) for more information on pool properties.

```
# zfs list
NAME                      USED  AVAIL  REFER  MOUNTPOINT
pool                      450K   457G    18K  /pool
pool/home                 315K   457G    21K  /export/home
pool/home/anne             18K   457G    18K  /export/home/anne
pool/home/bob             276K   457G   276K  /export/home/bob
```

### Example 6: Setting a Quota on a ZFS File System
The following command sets a quota of 50 Gbytes for pool/home/bob:

\# zfs set quota=50G pool/home/bob

### Example 7: Listing ZFS Properties
The following command lists all properties for pool/home/bob:

```
# zfs get all pool/home/bob
NAME           PROPERTY              VALUE                  SOURCE
pool/home/bob  type                  filesystem             -
pool/home/bob  creation              Tue Jul 21 15:53 2009  -
pool/home/bob  used                  21K                    -
pool/home/bob  available             20.0G                  -
pool/home/bob  referenced            21K                    -
pool/home/bob  compressratio         1.00x                  -
pool/home/bob  mounted               yes                    -
pool/home/bob  quota                 20G                    local
pool/home/bob  reservation           none                   default
pool/home/bob  recordsize            128K                   default
pool/home/bob  mountpoint            /pool/home/bob         default
pool/home/bob  sharenfs              off                    default
pool/home/bob  checksum              on                     default
pool/home/bob  compression           on                     local
pool/home/bob  atime                 on                     default
pool/home/bob  devices               on                     default
pool/home/bob  exec                  on                     default
pool/home/bob  setuid                on                     default
pool/home/bob  readonly              off                    default
pool/home/bob  zoned                 off                    default
pool/home/bob  snapdir               hidden                 default
pool/home/bob  acltype               off                    default
pool/home/bob  aclmode               discard                default
pool/home/bob  aclinherit            restricted             default
pool/home/bob  canmount              on                     default
pool/home/bob  xattr                 on                     default
pool/home/bob  copies                1                      default
pool/home/bob  version               4                      -
pool/home/bob  utf8only              off                    -
pool/home/bob  normalization         none                   -
pool/home/bob  casesensitivity       sensitive              -
pool/home/bob  vscan                 off                    default
pool/home/bob  nbmand                off                    default
pool/home/bob  sharesmb              off                    default
pool/home/bob  refquota              none                   default
pool/home/bob  refreservation        none                   default
pool/home/bob  primarycache          all                    default
pool/home/bob  secondarycache        all                    default
pool/home/bob  usedbysnapshots       0                      -
pool/home/bob  usedbydataset         21K                    -
pool/home/bob  usedbychildren        0                      -
pool/home/bob  usedbyrefreservation  0                      -
```

The following command gets a single property value:

```
# zfs get -H -o value compression pool/home/bob
on
```

The following command lists all properties with local settings for pool/home/bob:

```
# zfs get -r -s local -o name,property,value all pool/home/bob
NAME           PROPERTY              VALUE
pool/home/bob  quota                 20G
pool/home/bob  compression           on
```

### Example 8: Rolling Back a ZFS File System
The following command reverts the contents of pool/home/anne to the snapshot named yesterday, deleting all intermediate snapshots:

\# zfs rollback -r pool/home/anne@yesterday

### Example 9: Creating a ZFS Clone
The following command creates a writable file system whose initial contents are the same as pool/home/bob@yesterday.

\# zfs clone pool/home/bob@yesterday pool/clone

### Example 10: Promoting a ZFS Clone
The following commands illustrate how to test out changes to a file system, and then replace the original file system with the changed one, using clones, clone promotion, and renaming:

```
# zfs create pool/project/production
  populate /pool/project/production with data
# zfs snapshot pool/project/production@today
# zfs clone pool/project/production@today pool/project/beta
  make changes to /pool/project/beta and test them
# zfs promote pool/project/beta
# zfs rename pool/project/production pool/project/legacy
# zfs rename pool/project/beta pool/project/production
  once the legacy version is no longer needed, it can be destroyed
# zfs destroy pool/project/legacy
```

### Example 11: Inheriting ZFS Properties
The following command causes pool/home/bob and pool/home/anne to inherit the checksum property from their parent.

\# zfs inherit checksum pool/home/bob pool/home/anne

### Example 12: Remotely Replicating ZFS Data
The following commands send a full stream and then an incremental stream to a remote machine, restoring them into poolB/received/fs@a and poolB/received/fs@b, respectively. poolB must contain the file system poolB/received, and must not initially contain poolB/received/fs.

```
# zfs send pool/fs@a |
    ssh host zfs receive poolB/received/fs@a
# zfs send -i a pool/fs@b |
    ssh host zfs receive poolB/received/fs
```

### Example 13: Using the zfs receive -d Option
The following command sends a full stream of poolA/fsA/fsB@snap to a remote machine, receiving it into poolB/received/fsA/fsB@snap. The fsA/fsB@snap portion of the received snapshot's name is determined from the name of the sent snapshot. poolB must contain the file system poolB/received. If poolB/received/fsA does not exist, it is created as an empty file system.

```
# zfs send poolA/fsA/fsB@snap |
    ssh host zfs receive -d poolB/received
```

### Example 14: Setting User Properties
The following example sets the user-defined com.example:department property for a dataset:

\# zfs set com.example:department=12345 tank/accounting

### Example 15: Performing a Rolling Snapshot
The following example shows how to maintain a history of snapshots with a consistent naming scheme. To keep a week's worth of snapshots, the user destroys the oldest snapshot, renames the remaining snapshots, and then creates a new snapshot, as follows:

```
# zfs destroy -r pool/users@7daysago
# zfs rename -r pool/users@6daysago @7daysago
# zfs rename -r pool/users@5daysago @6daysago
# zfs rename -r pool/users@4daysago @5daysago
# zfs rename -r pool/users@3daysago @4daysago
# zfs rename -r pool/users@2daysago @3daysago
# zfs rename -r pool/users@yesterday @2daysago
# zfs rename -r pool/users@today @yesterday
# zfs snapshot -r pool/users@today
```

### Example 16: Setting sharenfs Property Options on a ZFS File System
The following commands show how to set sharenfs property options to enable read-write access for a set of IP addresses and to enable root access for system "neo" on the tank/home file system:

\# zfs set sharenfs='rw=@123.123.0.0/16:[::1],root=neo' tank/home

If you are using DNS for host name resolution, specify the fully-qualified hostname.

### Example 17: Delegating ZFS Administration Permissions on a ZFS Dataset
The following example shows how to set permissions so that user cindys can create, destroy, mount, and take snapshots on tank/cindys. The permissions on tank/cindys are also displayed.

```
# zfs allow cindys create,destroy,mount,snapshot tank/cindys
# zfs allow tank/cindys
---- Permissions on tank/cindys --------------------------------------
Local+Descendent permissions:
        user cindys create,destroy,mount,snapshot
```

Because the tank/cindys mount point permission is set to 755 by default, user cindys will be unable to mount file systems under tank/cindys. Add an ACE similar to the following syntax to provide mount point access:

\# chmod A+user:cindys:add_subdirectory:allow /tank/cindys

### Example 18: Delegating Create Time Permissions on a ZFS Dataset
The following example shows how to grant anyone in the group staff to create file systems in tank/users. This syntax also allows staff members to destroy their own file systems, but not destroy anyone else's file system. The permissions on tank/users are also displayed.

```
# zfs allow staff create,mount tank/users
# zfs allow -c destroy tank/users
# zfs allow tank/users
---- Permissions on tank/users ---------------------------------------
Permission sets:
        destroy
Local+Descendent permissions:
        group staff create,mount
```

### Example 19: Defining and Granting a Permission Set on a ZFS Dataset
The following example shows how to define and grant a permission set on the tank/users file system. The permissions on tank/users are also displayed.

```
# zfs allow -s @pset create,destroy,snapshot,mount tank/users
# zfs allow staff @pset tank/users
# zfs allow tank/users
---- Permissions on tank/users ---------------------------------------
Permission sets:
        @pset create,destroy,mount,snapshot
Local+Descendent permissions:
        group staff @pset
```

### Example 20: Delegating Property Permissions on a ZFS Dataset
The following example shows to grant the ability to set quotas and reservations on the users/home file system. The permissions on users/home are also displayed.

```
# zfs allow cindys quota,reservation users/home
# zfs allow users/home
---- Permissions on users/home ---------------------------------------
Local+Descendent permissions:
        user cindys quota,reservation
cindys% zfs set quota=10G users/home/marks
cindys% zfs get quota users/home/marks
NAME              PROPERTY  VALUE  SOURCE
users/home/marks  quota     10G    local
```

### Example 21: Removing ZFS Delegated Permissions on a ZFS Dataset
The following example shows how to remove the snapshot permission from the staff group on the tank/users file system. The permissions on tank/users are also displayed.

```
# zfs unallow staff snapshot tank/users
# zfs allow tank/users
---- Permissions on tank/users ---------------------------------------
Permission sets:
        @pset create,destroy,mount,snapshot
Local+Descendent permissions:
        group staff @pset
```

### Example 22: Showing the differences between a snapshot and a ZFS Dataset
The following example shows how to see what has changed between a prior snapshot of a ZFS dataset and its current state. The -F option is used to indicate type information for the files affected.

```
# zfs diff -F tank/test@before tank/test
M       /       /tank/test/
M       F       /tank/test/linked      (+1)
R       F       /tank/test/oldname -> /tank/test/newname
-       F       /tank/test/deleted
+       F       /tank/test/created
M       F       /tank/test/modified
```

### Example 23: Creating a bookmark
The following example creates a bookmark to a snapshot. This bookmark can then be used instead of a snapshot in send streams.

\# zfs bookmark rpool@snapshot rpool#bookmark

### Example 24: Setting sharesmb Property Options on a ZFS File System
The following example show how to share SMB filesystem through ZFS. Note that a user and their password must be given.

\# smbmount //127.0.0.1/share_tmp /mnt/tmp -o user=workgroup/turbo,password=obrut,uid=1000

Minimal /etc/samba/smb.conf configuration is required, as follows.

Samba will need to bind to the loopback interface for the ZFS utilities to communicate with Samba. This is the default behavior for most Linux distributions.

Samba must be able to authenticate a user. This can be done in a number of ways (passwd(5), LDAP, smbpasswd(5), &c.). How to do this is outside the scope of this document – refer to smb.conf(5) for more information.

See the USERSHARES section for all configuration options, in case you need to modify any options of the share afterwards. Do note that any changes done with the net(8) command will be undone if the share is ever unshared (like via a reboot).

## ENVIRONMENT VARIABLES
ZFS_COLOR

Use ANSI color in zfs diff and zfs list output.

ZFS_MOUNT_HELPER

Cause zfs mount to use mount(8) to mount ZFS datasets. This option is provided for backwards compatibility with older ZFS versions.

ZFS_SET_PIPE_MAX

Tells zfs to set the maximum pipe size for sends/receives. Disabled by default on Linux due to an unfixed deadlock in Linux's pipe size handling code.

ZFS_MODULE_TIMEOUT

Time, in seconds, to wait for /dev/zfs to appear. Defaults to 10, max 600 (10 minutes). If <0, wait forever; if 0, don't wait.

## INTERFACE STABILITY
Committed.

## SEE ALSO
attr(1), gzip(1), ssh(1), chmod(2), fsync(2), stat(2), write(2), acl(5), attributes(5), exports(5), zfsconcepts(7), zfsprops(7), exportfs(8), mount(8), net(8), selinux(8), zfs-allow(8), zfs-bookmark(8), zfs-change-key(8), zfs-clone(8), zfs-create(8), zfs-destroy(8), zfs-diff(8), zfs-get(8), zfs-groupspace(8), zfs-hold(8), zfs-inherit(8), zfs-jail(8), zfs-list(8), zfs-load-key(8), zfs-mount(8), zfs-program(8), zfs-project(8), zfs-projectspace(8), zfs-promote(8), zfs-receive(8), zfs-redact(8), zfs-release(8), zfs-rename(8), zfs-rollback(8), zfs-send(8), zfs-set(8), zfs-share(8), zfs-snapshot(8), zfs-unallow(8), zfs-unjail(8), zfs-unload-key(8), zfs-unmount(8), zfs-unshare(8), zfs-upgrade(8), zfs-userspace(8), zfs-wait(8), zpool(8)


zfs-allow

package: zfs-utils

title: zfs-allow(8)

text:
# zfs-allow(8)

## NAME
zfs-allow — delegate ZFS administration permissions to unprivileged users

## SYNOPSIS
zfs

allow [-dglu] user|group[,user|group]… perm|@setname[,perm|@setname]… filesystem|volume

zfs

allow [-dl] -e|everyone perm|@setname[,perm|@setname]… filesystem|volume

zfs

allow -c perm|@setname[,perm|@setname]… filesystem|volume

zfs

allow -s @setname perm|@setname[,perm|@setname]… filesystem|volume

zfs

unallow [-dglru] user|group[,user|group]… [perm|@setname[,perm|@setname]…] filesystem|volume

zfs

unallow [-dlr] -e|everyone [perm|@setname[,perm|@setname]…] filesystem|volume

zfs

unallow [-r] -c [perm|@setname[,perm|@setname]…] filesystem|volume

zfs

unallow [-r] -s @setname [perm|@setname[,perm|@setname]…] filesystem|volume

## DESCRIPTION
zfs allow filesystem|volume

Displays permissions that have been delegated on the specified filesystem or volume. See the other forms of zfs allow for more information. Delegations are supported under Linux with the exception of mount, unmount, mountpoint, canmount, rename, and share. These permissions cannot be delegated because the Linux mount(8) command restricts modifications of the global namespace to the root user.

zfs allow [-dglu] user|group[,user|group]… perm|@setname[,perm|@setname]… filesystem|volume

zfs allow [-dl] -e|everyone perm|@setname[,perm|@setname]… filesystem|volume

Delegates ZFS administration permission for the file systems to non-privileged users. -d

Allow only for the descendent file systems.

-e|everyone

Specifies that the permissions be delegated to everyone.

-g group[,group]…

Explicitly specify that permissions are delegated to the group.

-l

Allow "locally" only for the specified file system.

-u user[,user]…

Explicitly specify that permissions are delegated to the user.

user|group[,user|group]…

Specifies to whom the permissions are delegated. Multiple entities can be specified as a comma-separated list. If neither of the -gu options are specified, then the argument is interpreted preferentially as the keyword everyone, then as a user name, and lastly as a group name. To specify a user or group named "everyone", use the -g or -u options. To specify a group with the same name as a user, use the -g options.

perm|@setname[,perm|@setname]…

The permissions to delegate. Multiple permissions may be specified as a comma-separated list. Permission names are the same as ZFS subcommand and property names. See the property list below. Property set names, which begin with @, may be specified. See the -s form below for details.

If neither of the -dl options are specified, or both are, then the permissions are allowed for the file system or volume, and all of its descendants.

Permissions are generally the ability to use a ZFS subcommand or change a ZFS property. The following permissions are available:

NAME

TYPE

NOTES

allow

subcommand

Must also have the permission that is being allowed

bookmark

subcommand

clone

subcommand

Must also have the create ability and mount ability in the origin file system

create

subcommand

Must also have the mount ability. Must also have the refreservation ability to create a non-sparse volume.

destroy

subcommand

Must also have the mount ability

diff

subcommand

Allows lookup of paths within a dataset given an object number, and the ability to create snapshots necessary to zfs diff.

hold

subcommand

Allows adding a user hold to a snapshot

load-key

subcommand

Allows loading and unloading of encryption key (see zfs load-key and zfs unload-key).

change-key

subcommand

Allows changing an encryption key via zfs change-key.

mount

subcommand

Allows mounting/unmounting ZFS datasets

promote

subcommand

Must also have the mount and promote ability in the origin file system

receive

subcommand

Must also have the mount and create ability, required for zfs receive -F (see also receive:append for limited, non forced receive)

release

subcommand

Allows releasing a user hold which might destroy the snapshot

rename

subcommand

Must also have the mount and create ability in the new parent

rollback

subcommand

Must also have the mount ability

send

subcommand

Allows sending a replication stream of a dataset.

send:raw

subcommand

Only allows sending raw replication streams, preventing encrypted datasets being sent in decrypted form.

share

subcommand

Allows sharing file systems over NFS or SMB protocols

snapshot

subcommand

Must also have the mount ability

receive:append

other

Must also have the mount and create ability, limited receive ability (can not do receive -F)

groupquota

other

Allows accessing any groupquota@… property

groupobjquota

other

Allows accessing any groupobjquota@… property

groupused

other

Allows reading any groupused@… property

groupobjused

other

Allows reading any groupobjused@… property

userprop

other

Allows changing any user property

userquota

other

Allows accessing any userquota@… property

userobjquota

other

Allows accessing any userobjquota@… property

userused

other

Allows reading any userused@… property

userobjused

other

Allows reading any userobjused@… property

projectobjquota

other

Allows accessing any projectobjquota@… property

projectquota

other

Allows accessing any projectquota@… property

projectobjused

other

Allows reading any projectobjused@… property

projectused

other

Allows reading any projectused@… property

aclinherit

property

aclmode

property

acltype

property

atime

property

canmount

property

casesensitivity

property

checksum

property

compression

property

context

property

copies

property

dedup

property

defcontext

property

devices

property

dnodesize

property

encryption

property

exec

property

filesystem_limit

property

fscontext

property

keyformat

property

keylocation

property

logbias

property

mlslabel

property

mountpoint

property

nbmand

property

normalization

property

overlay

property

pbkdf2iters

property

primarycache

property

quota

property

readonly

property

recordsize

property

redundant_metadata

property

refquota

property

refreservation

property

relatime

property

reservation

property

rootcontext

property

secondarycache

property

setuid

property

sharenfs

property

sharesmb

property

snapdev

property

snapdir

property

snapshot_limit

property

special_small_blocks

property

sync

property

utf8only

property

version

property

volblocksize

property

volmode

property

volsize

property

vscan

property

xattr

property

zoned

property

zfs allow -c perm|@setname[,perm|@setname]… filesystem|volume

Sets "create time" permissions. These permissions are granted (locally) to the creator of any newly-created descendent file system.

zfs allow -s @setname perm|@setname[,perm|@setname]… filesystem|volume

Defines or adds permissions to a permission set. The set can be used by other zfs allow commands for the specified file system and its descendants. Sets are evaluated dynamically, so changes to a set are immediately reflected. Permission sets follow the same naming restrictions as ZFS file systems, but the name must begin with @, and can be no more than 64 characters long.

zfs unallow [-dglru] user|group[,user|group]… [perm|@setname[,perm|@setname]…] filesystem|volume

zfs unallow [-dlr] -e|everyone [perm|@setname[,perm|@setname]…] filesystem|volume

zfs unallow [-r] -c [perm|@setname[,perm|@setname]…] filesystem|volume

Removes permissions that were granted with the zfs allow command. No permissions are explicitly denied, so other permissions granted are still in effect. For example, if the permission is granted by an ancestor. If no permissions are specified, then all permissions for the specified user, group, or everyone are removed. Specifying everyone (or using the -e option) only removes the permissions that were granted to everyone, not all permissions for every user and group. See the zfs allow command for a description of the -ldugec options. -r

Recursively remove the permissions from this file system and all descendants.

zfs unallow [-r] -s @setname [perm|@setname[,perm|@setname]…] filesystem|volume

Removes permissions from a permission set. If no permissions are specified, then all permissions are removed, thus removing the set entirely.

## EXAMPLES

### Example 1: Delegating ZFS Administration Permissions on a ZFS Dataset
The following example shows how to set permissions so that user cindys can create, destroy, mount, and take snapshots on tank/cindys. The permissions on tank/cindys are also displayed.

```
# zfs allow cindys create,destroy,mount,snapshot tank/cindys
# zfs allow tank/cindys
---- Permissions on tank/cindys --------------------------------------
Local+Descendent permissions:
        user cindys create,destroy,mount,snapshot
```

Because the tank/cindys mount point permission is set to 755 by default, user cindys will be unable to mount file systems under tank/cindys. Add an ACE similar to the following syntax to provide mount point access:

\# chmod A+user:cindys:add_subdirectory:allow /tank/cindys

### Example 2: Delegating Create Time Permissions on a ZFS Dataset
The following example shows how to grant anyone in the group staff to create file systems in tank/users. This syntax also allows staff members to destroy their own file systems, but not destroy anyone else's file system. The permissions on tank/users are also displayed.

```
# zfs allow staff create,mount tank/users
# zfs allow -c destroy tank/users
# zfs allow tank/users
---- Permissions on tank/users ---------------------------------------
Permission sets:
        destroy
Local+Descendent permissions:
        group staff create,mount
```

### Example 3: Defining and Granting a Permission Set on a ZFS Dataset
The following example shows how to define and grant a permission set on the tank/users file system. The permissions on tank/users are also displayed.

```
# zfs allow -s @pset create,destroy,snapshot,mount tank/users
# zfs allow staff @pset tank/users
# zfs allow tank/users
---- Permissions on tank/users ---------------------------------------
Permission sets:
        @pset create,destroy,mount,snapshot
Local+Descendent permissions:
        group staff @pset
```

### Example 4: Delegating Property Permissions on a ZFS Dataset
The following example shows to grant the ability to set quotas and reservations on the users/home file system. The permissions on users/home are also displayed.

```
# zfs allow cindys quota,reservation users/home
# zfs allow users/home
---- Permissions on users/home ---------------------------------------
Local+Descendent permissions:
        user cindys quota,reservation
cindys% zfs set quota=10G users/home/marks
cindys% zfs get quota users/home/marks
NAME              PROPERTY  VALUE  SOURCE
users/home/marks  quota     10G    local
```

### Example 5: Removing ZFS Delegated Permissions on a ZFS Dataset
The following example shows how to remove the snapshot permission from the staff group on the tank/users file system. The permissions on tank/users are also displayed.

```
# zfs unallow staff snapshot tank/users
# zfs allow tank/users
---- Permissions on tank/users ---------------------------------------
Permission sets:
        @pset create,destroy,mount,snapshot
Local+Descendent permissions:
        group staff @pset
```


zfs-bookmark

title: zfs-bookmark(8)

summary: create bookmark of ZFS snapshot

text:
# zfs-bookmark(8)

## NAME
zfs-bookmark — create bookmark of ZFS snapshot

## SYNOPSIS
zfs

bookmark snapshot|bookmark newbookmark

## DESCRIPTION
Creates a new bookmark of the given snapshot or bookmark. Bookmarks mark the point in time when the snapshot was created, and can be used as the incremental source for a zfs send.

When creating a bookmark from an existing redaction bookmark, the resulting bookmark is not a redaction bookmark.

This feature must be enabled to be used. See zpool-features(7) for details on ZFS feature flags and the bookmarks feature.

## EXAMPLES

### Example 1: Creating a bookmark
The following example creates a bookmark to a snapshot. This bookmark can then be used instead of a snapshot in send streams.

\# zfs bookmark rpool@snapshot rpool#bookmark

## SEE ALSO
zfs-destroy(8), zfs-send(8), zfs-snapshot(8)


zfs-change-key

title: zfs-change-key(8)

text:
# zfs-change-key(8)

## NAME
zfs-load-key — load, unload, or change encryption key of ZFS dataset

## SYNOPSIS
zfs

load-key [-nr] [-L keylocation] -a|filesystem

zfs

unload-key [-r] -a|filesystem

zfs

change-key [-l] [-o keylocation=value] [-o keyformat=value] [-o pbkdf2iters=value] filesystem

zfs

change-key -i [-l] filesystem

## DESCRIPTION
zfs load-key [-nr] [-L keylocation] -a|filesystem

Load the key for filesystem, allowing it and all children that inherit the keylocation property to be accessed. The key will be expected in the format specified by the keyformat and location specified by the keylocation property. Note that if the keylocation is set to prompt the terminal will interactively wait for the key to be entered. Loading a key will not automatically mount the dataset. If that functionality is desired, zfs mount -l will ask for the key and mount the dataset (see zfs-mount(8)). Once the key is loaded the keystatus property will become available. -r

Recursively loads the keys for the specified filesystem and all descendent encryption roots.

-a

Loads the keys for all encryption roots in all imported pools.

-n

Do a dry-run ("No-op") load-key. This will cause zfs to simply check that the provided key is correct. This command may be run even if the key is already loaded.

-L keylocation

Use keylocation instead of the keylocation property. This will not change the value of the property on the dataset. Note that if used with either -r or -a, keylocation may only be given as prompt.

zfs unload-key [-r] -a|filesystem

Unloads a key from ZFS, removing the ability to access the dataset and all of its children that inherit the keylocation property. This requires that the dataset is not currently open or mounted. Once the key is unloaded the keystatus property will become unavailable. -r

Recursively unloads the keys for the specified filesystem and all descendent encryption roots.

-a

Unloads the keys for all encryption roots in all imported pools.

zfs change-key [-l] [-o keylocation=value] [-o keyformat=value] [-o pbkdf2iters=value] filesystem

zfs change-key -i [-l] filesystem

Changes the user's key (e.g. a passphrase) used to access a dataset. This command requires that the existing key for the dataset is already loaded. This command may also be used to change the keylocation, keyformat, and pbkdf2iters properties as needed. If the dataset was not previously an encryption root it will become one. Alternatively, the -i flag may be provided to cause an encryption root to inherit the parent's key instead. If the user's key is compromised, zfs change-key does not necessarily protect existing or newly-written data from attack. Newly-written data will continue to be encrypted with the same master key as the existing data. The master key is compromised if an attacker obtains a user key and the corresponding wrapped master key. Currently, zfs change-key does not overwrite the previous wrapped master key on disk, so it is accessible via forensic analysis for an indeterminate length of time.

In the event of a master key compromise, ideally the drives should be securely erased to remove all the old data (which is readable using the compromised master key), a new pool created, and the data copied back. This can be approximated in place by creating new datasets, copying the data (e.g. using zfs send | zfs recv), and then clearing the free space with zpool trim --secure if supported by your hardware, otherwise zpool initialize.

-l

Ensures the key is loaded before attempting to change the key. This is effectively equivalent to running zfs load-key filesystem; zfs change-key filesystem

-o property=value

Allows the user to set encryption key properties (keyformat, keylocation, and pbkdf2iters) while changing the key. This is the only way to alter keyformat and pbkdf2iters after the dataset has been created.

-i

Indicates that zfs should make filesystem inherit the key of its parent. Note that this command can only be run on an encryption root that has an encrypted parent.

### Encryption
Enabling the encryption feature allows for the creation of encrypted filesystems and volumes. ZFS will encrypt file and volume data, file attributes, ACLs, permission bits, directory listings, FUID mappings, and userused/groupused data. ZFS will not encrypt metadata related to the pool structure, including dataset and snapshot names, dataset hierarchy, properties, file size, file holes, and deduplication tables (though the deduplicated data itself is encrypted).

Key rotation is managed by ZFS. Changing the user's key (e.g. a passphrase) does not require re-encrypting the entire dataset. Datasets can be scrubbed, resilvered, renamed, and deleted without the encryption keys being loaded (see the load-key subcommand for more info on key loading).

Creating an encrypted dataset requires specifying the encryption and keyformat properties at creation time, along with an optional keylocation and pbkdf2iters. After entering an encryption key, the created dataset will become an encryption root. Any descendant datasets will inherit their encryption key from the encryption root by default, meaning that loading, unloading, or changing the key for the encryption root will implicitly do the same for all inheriting datasets. If this inheritance is not desired, simply supply a keyformat when creating the child dataset or use zfs change-key to break an existing relationship, creating a new encryption root on the child. Note that the child's keyformat may match that of the parent while still creating a new encryption root, and that changing the encryption property alone does not create a new encryption root; this would simply use a different cipher suite with the same key as its encryption root. The one exception is that clones will always use their origin's encryption key. As a result of this exception, some encryption-related properties (namely keystatus, keyformat, keylocation, and pbkdf2iters) do not inherit like other ZFS properties and instead use the value determined by their encryption root. Encryption root inheritance can be tracked via the read-only encryptionroot property.

Encryption changes the behavior of a few ZFS operations. Encryption is applied after compression so compression ratios are preserved. Normally checksums in ZFS are 256 bits long, but for encrypted data the checksum is 128 bits of the user-chosen checksum and 128 bits of MAC from the encryption suite, which provides additional protection against maliciously altered data. Deduplication is still possible with encryption enabled but for security, datasets will only deduplicate against themselves, their snapshots, and their clones.

There are a few limitations on encrypted datasets. Encrypted data cannot be embedded via the embedded_data feature. Encrypted datasets may not have copies=3 since the implementation stores some encryption metadata where the third copy would normally be. Since compression is applied before encryption, datasets may be vulnerable to a CRIME-like attack if applications accessing the data allow for it. Deduplication with encryption will leak information about which blocks are equivalent in a dataset and will incur an extra CPU cost for each block written.

## SEE ALSO
zfsprops(7), zfs-create(8), zfs-set(8)


zfs-clone

title: zfs-clone(8)

summary: clone snapshot of ZFS dataset

text:
# zfs-clone(8)

## NAME
zfs-clone — clone snapshot of ZFS dataset

## SYNOPSIS
zfs

clone [-pu] [-o property=value]… snapshot filesystem|volume

## DESCRIPTION
See the Clones section of zfsconcepts(7) for details. The target dataset can be located anywhere in the ZFS hierarchy, and is created as the same type as the original.

-o property=value

Sets the specified property; see zfs create for details.

-p

Creates all the non-existing parent datasets. Datasets created in this manner are automatically mounted according to the mountpoint property inherited from their parent. If the target filesystem or volume already exists, the operation completes successfully.

-u

Do not mount the newly created file system.

## EXAMPLES

### Example 1: Creating a ZFS Clone
The following command creates a writable file system whose initial contents are the same as pool/home/bob@yesterday.

\# zfs clone pool/home/bob@yesterday pool/clone

### Example 2: Promoting a ZFS Clone
The following commands illustrate how to test out changes to a file system, and then replace the original file system with the changed one, using clones, clone promotion, and renaming:

```
# zfs create pool/project/production
  populate /pool/project/production with data
# zfs snapshot pool/project/production@today
# zfs clone pool/project/production@today pool/project/beta
  make changes to /pool/project/beta and test them
# zfs promote pool/project/beta
# zfs rename pool/project/production pool/project/legacy
# zfs rename pool/project/beta pool/project/production
  once the legacy version is no longer needed, it can be destroyed
# zfs destroy pool/project/legacy
```

## SEE ALSO
zfs-promote(8), zfs-snapshot(8)


zfs-create

title: zfs-create(8)

summary: create ZFS dataset

text:
# zfs-create(8)

## NAME
zfs-create — create ZFS dataset

## SYNOPSIS
zfs

create [-Pnpuv] [-o property=value]… filesystem

zfs

create [-ps] [-b blocksize] [-o property=value]… -V size volume

## DESCRIPTION
zfs create [-Pnpuv] [-o property=value]… filesystem

Creates a new ZFS file system. The file system is automatically mounted according to the mountpoint property inherited from the parent, unless the -u option is used. -o property=value

Sets the specified property as if the command zfs set property=value was invoked at the same time the dataset was created. Any editable ZFS property can also be set at creation time. Multiple -o options can be specified. An error results if the same property is specified in multiple -o options.

-p

Creates all the non-existing parent datasets. Datasets created in this manner are automatically mounted according to the mountpoint property inherited from their parent. Any property specified on the command line using the -o option is ignored. If the target filesystem already exists, the operation completes successfully.

-n

Do a dry-run ("No-op") creation. No datasets will be created. This is useful in conjunction with the -v or -P flags to validate properties that are passed via -o options and those implied by other options. The actual dataset creation can still fail due to insufficient privileges or available capacity.

-P

Print machine-parsable verbose information about the created dataset. Each line of output contains a key and one or two values, all separated by tabs. The create_ancestors and create keys have filesystem as their only value. The create_ancestors key only appears if the -p option is used. The property key has two values, a property name that property's value. The property key may appear zero or more times, once for each property that will be set local to filesystem due to the use of the -o option.

-u

Do not mount the newly created file system.

-v

Print verbose information about the created dataset.

zfs create [-ps] [-b blocksize] [-o property=value]… -V size volume

Creates a volume of the given size. The volume is exported as a block device in /dev/zvol/path, where path is the name of the volume in the ZFS namespace. The size represents the logical size as exported by the device. By default, a reservation of equal size is created. size is automatically rounded up to the nearest multiple of the blocksize.

-b blocksize

Equivalent to -o volblocksize=blocksize. If this option is specified in conjunction with -o volblocksize, the resulting behavior is undefined.

-o property=value

Sets the specified property as if the zfs set property=value command was invoked at the same time the dataset was created. Any editable ZFS property can also be set at creation time. Multiple -o options can be specified. An error results if the same property is specified in multiple -o options.

-p

Creates all the non-existing parent datasets. Datasets created in this manner are automatically mounted according to the mountpoint property inherited from their parent. Any property specified on the command line using the -o option is ignored. If the target filesystem already exists, the operation completes successfully.

-s

Creates a sparse volume with no reservation. See volsize in the Native Properties section of zfsprops(7) for more information about sparse volumes.

-n

Do a dry-run ("No-op") creation. No datasets will be created. This is useful in conjunction with the -v or -P flags to validate properties that are passed via -o options and those implied by other options. The actual dataset creation can still fail due to insufficient privileges or available capacity.

-P

Print machine-parsable verbose information about the created dataset. Each line of output contains a key and one or two values, all separated by tabs. The create_ancestors and create keys have volume as their only value. The create_ancestors key only appears if the -p option is used. The property key has two values, a property name that property's value. The property key may appear zero or more times, once for each property that will be set local to volume due to the use of the -b or -o options, as well as refreservation if the volume is not sparse.

-v

Print verbose information about the created dataset.

### ZFS for Swap
Swapping to a ZFS volume is prone to deadlock and not recommended. See OpenZFS FAQ.

Swapping to a file on a ZFS filesystem is not supported.

## EXAMPLES

### Example 1: Creating a ZFS File System Hierarchy
The following commands create a file system named pool/home and a file system named pool/home/bob. The mount point /export/home is set for the parent file system, and is automatically inherited by the child file system.

\# zfs create pool/home

\# zfs set mountpoint=/export/home pool/home

\# zfs create pool/home/bob

### Example 2: Promoting a ZFS Clone
The following commands illustrate how to test out changes to a file system, and then replace the original file system with the changed one, using clones, clone promotion, and renaming:

```
# zfs create pool/project/production
  populate /pool/project/production with data
# zfs snapshot pool/project/production@today
# zfs clone pool/project/production@today pool/project/beta
  make changes to /pool/project/beta and test them
# zfs promote pool/project/beta
# zfs rename pool/project/production pool/project/legacy
# zfs rename pool/project/beta pool/project/production
  once the legacy version is no longer needed, it can be destroyed
# zfs destroy pool/project/legacy
```

## SEE ALSO
zfs-destroy(8), zfs-list(8), zpool-create(8)


zfs-destroy

title: zfs-destroy(8)

text:
# zfs-destroy(8)

## NAME
zfs-destroy — destroy ZFS dataset, snapshots, or bookmark

## SYNOPSIS
zfs

destroy [-Rfnprv] filesystem|volume

zfs

destroy [-Rdnprv] filesystem|volume@snap[%snap[,snap[%snap]]]…

zfs

destroy filesystem|volume#bookmark

## DESCRIPTION
zfs destroy [-Rfnprv] filesystem|volume

Destroys the given dataset. By default, the command unshares any file systems that are currently shared, unmounts any file systems that are currently mounted, and refuses to destroy a dataset that has active dependents (children or clones). -R

Recursively destroy all dependents, including cloned file systems outside the target hierarchy.

-f

Forcibly unmount file systems. This option has no effect on non-file systems or unmounted file systems.

-n

Do a dry-run ("No-op") deletion. No data will be deleted. This is useful in conjunction with the -v or -p flags to determine what data would be deleted.

-p

Print machine-parsable verbose information about the deleted data.

-r

Recursively destroy all children.

-v

Print verbose information about the deleted data.

Extreme care should be taken when applying either the -r or the -R options, as they can destroy large portions of a pool and cause unexpected behavior for mounted file systems in use.

zfs destroy [-Rdnprv] filesystem|volume@snap[%snap[,snap[%snap]]]…

Attempts to destroy the given snapshot(s). This will fail if any clones of the snapshot exist or if the snapshot is held. In this case, by default, zfs destroy will have no effect and exit in error. If the -d option is applied, the command will instead mark the given snapshot for automatic destruction as soon as it becomes eligible. While marked for destruction, a snapshot remains visible, and the user may create new clones from it and place new holds on it. The read-only snapshot properties defer_destroy and userrefs are used by zfs destroy to determine eligibility and marked status.

An inclusive range of snapshots may be specified by separating the first and last snapshots with a percent sign. The first and/or last snapshots may be left blank, in which case the filesystem's oldest or newest snapshot will be implied.

Multiple snapshots (or ranges of snapshots) of the same filesystem or volume may be specified in a comma-separated list of snapshots. Only the snapshot's short name (the part after the @) should be specified when using a range or comma-separated list to identify multiple snapshots.

-R

Recursively destroy all clones of these snapshots, including the clones, snapshots, and children. If this flag is specified, the -d flag will have no effect.

-d

Rather than returning error if the given snapshot is ineligible for immediate destruction, mark it for deferred, automatic destruction once it becomes eligible.

-n

Do a dry-run ("No-op") deletion. No data will be deleted. This is useful in conjunction with the -p or -v flags to determine what data would be deleted.

-p

Print machine-parsable verbose information about the deleted data.

-r

Destroy (or mark for deferred deletion) all snapshots with this name in descendent file systems.

-v

Print verbose information about the deleted data.

Extreme care should be taken when applying either the -r or the -R options, as they can destroy large portions of a pool and cause unexpected behavior for mounted file systems in use.

zfs destroy filesystem|volume#bookmark

The given bookmark is destroyed.

## EXAMPLES

### Example 1: Creating and Destroying Multiple Snapshots
The following command creates snapshots named yesterday of pool/home and all of its descendent file systems. Each snapshot is mounted on demand in the .zfs/snapshot directory at the root of its file system. The second command destroys the newly created snapshots.

\# zfs snapshot -r pool/home@yesterday

\# zfs destroy -r pool/home@yesterday

### Example 2: Promoting a ZFS Clone
The following commands illustrate how to test out changes to a file system, and then replace the original file system with the changed one, using clones, clone promotion, and renaming:

```
# zfs create pool/project/production
  populate /pool/project/production with data
# zfs snapshot pool/project/production@today
# zfs clone pool/project/production@today pool/project/beta
  make changes to /pool/project/beta and test them
# zfs promote pool/project/beta
# zfs rename pool/project/production pool/project/legacy
# zfs rename pool/project/beta pool/project/production
  once the legacy version is no longer needed, it can be destroyed
# zfs destroy pool/project/legacy
```

### Example 3: Performing a Rolling Snapshot
The following example shows how to maintain a history of snapshots with a consistent naming scheme. To keep a week's worth of snapshots, the user destroys the oldest snapshot, renames the remaining snapshots, and then creates a new snapshot, as follows:

```
# zfs destroy -r pool/users@7daysago
# zfs rename -r pool/users@6daysago @7daysago
# zfs rename -r pool/users@5daysago @6daysago
# zfs rename -r pool/users@4daysago @5daysago
# zfs rename -r pool/users@3daysago @4daysago
# zfs rename -r pool/users@2daysago @3daysago
# zfs rename -r pool/users@yesterday @2daysago
# zfs rename -r pool/users@today @yesterday
# zfs snapshot -r pool/users@today
```

## SEE ALSO
zfs-create(8), zfs-hold(8), zfsprops(8)


zfs-diff

title: zfs-diff(8)

summary: show difference between ZFS snapshots

text:
# zfs-diff(8)

## NAME
zfs-diff — show difference between ZFS snapshots

## SYNOPSIS
zfs

diff [-FHth] snapshot snapshot|filesystem

## DESCRIPTION
Display the difference between a snapshot of a given filesystem and another snapshot of that filesystem from a later time or the current contents of the filesystem. The first column is a character indicating the type of change, the other columns indicate pathname, new pathname (in case of rename), change in link count, and optionally file type and/or change time. The types of change are:

-

The path has been removed

+

The path has been created

M

The path has been modified

R

The path has been renamed

-F

Display an indication of the type of file, in a manner similar to the -F option of ls(1). B

Block device

C

Character device

/

Directory

>

Door

|

Named pipe

@

Symbolic link

P

Event port

=

Socket

F

Regular file

-H

Give more parsable tab-separated output, without header lines and without arrows.

-t

Display the path's inode change time as the first column of output.

-h

Do not \0ooo-escape non-ASCII paths.

## EXAMPLES

### Example 1: Showing the differences between a snapshot and a ZFS Dataset
The following example shows how to see what has changed between a prior snapshot of a ZFS dataset and its current state. The -F option is used to indicate type information for the files affected.

```
# zfs diff -F tank/test@before tank/test
M       /       /tank/test/
M       F       /tank/test/linked      (+1)
R       F       /tank/test/oldname -> /tank/test/newname
-       F       /tank/test/deleted
+       F       /tank/test/created
M       F       /tank/test/modified
```

## SEE ALSO
zfs-snapshot(8)


zfs-get

title: zfs-get(8)

summary: set properties on ZFS datasets

text:
# zfs-get(8)

## NAME
zfs-set — set properties on ZFS datasets

## SYNOPSIS
zfs

set [-u] property=value [property=value]… filesystem|volume|snapshot…

zfs

get [-r|-d depth] [-Hp] [-j [--json-int]] [-o field[,field]…] [-s source[,source]…] [-t type[,type]…] all|property[,property]… [filesystem|volume|snapshot|bookmark]…

zfs

inherit [-rS] property filesystem|volume|snapshot…

## DESCRIPTION
zfs set [-u] property=value [property=value]… filesystem|volume|snapshot…

Only some properties can be edited. See zfsprops(7) for more information on what properties can be set and acceptable values. Numeric values can be specified as exact values, or in a human-readable form with a suffix of B, K, M, G, T, P, E, Z (for bytes, kilobytes, megabytes, gigabytes, terabytes, petabytes, exabytes, or zettabytes, respectively). User properties can be set on snapshots. For more information, see the User Properties section of zfsprops(7). -u

Update mountpoint, sharenfs, sharesmb property but do not mount or share the dataset.

zfs get [-r|-d depth] [-Hp] [-j [--json-int]] [-o field[,field]…] [-s source[,source]…] [-t type[,type]…] all|property[,property]… [filesystem|volume|snapshot|bookmark]…

Displays properties for the given datasets. If no datasets are specified, then the command displays properties for all datasets on the system. For each property, the following columns are displayed: name

Dataset name

property

Property name

value

Property value

source

Property source local, default, inherited, temporary, received, or - (none).

All columns are displayed by default, though this can be controlled by using the -o option. This command takes a comma-separated list of properties as described in the Native Properties and User Properties sections of zfsprops(7).

The value all can be used to display all properties that apply to the given dataset's type (filesystem, volume, snapshot, or bookmark).

-j, --json [--json-int]

Display the output in JSON format. Specify --json-int to display numbers in integer format instead of strings for JSON output.

-H

Display output in a form more easily parsed by scripts. Any headers are omitted, and fields are explicitly separated by a single tab instead of an arbitrary amount of space.

-d depth

Recursively display any children of the dataset, limiting the recursion to depth. A depth of 1 will display only the dataset and its direct children.

-o field

A comma-separated list of columns to display, defaults to name,property,value,source.

-p

Display numbers in parsable (exact) values.

-r

Recursively display properties for any children.

-s source

A comma-separated list of sources to display. Those properties coming from a source other than those in this list are ignored. Each source must be one of the following: local, default, inherited, temporary, received, or none. The default value is all sources.

-t type

A comma-separated list of types to display, where type is one of filesystem, snapshot, volume, bookmark, or all. fs, snap, or vol can be used as aliases for filesystem, snapshot, or volume.

zfs inherit [-rS] property filesystem|volume|snapshot…

Clears the specified property, causing it to be inherited from an ancestor, restored to default if no ancestor has the property set, or with the -S option reverted to the received value if one exists. See zfsprops(7) for a listing of default values, and details on which properties can be inherited. -r

Recursively inherit the given property for all children.

-S

Revert the property to the received value, if one exists; otherwise, for non-inheritable properties, to the default; otherwise, operate as if the -S option was not specified.

## EXAMPLES

### Example 1: Creating a ZFS File System Hierarchy
The following commands create a file system named pool/home and a file system named pool/home/bob. The mount point /export/home is set for the parent file system, and is automatically inherited by the child file system.

\# zfs create pool/home

\# zfs set mountpoint=/export/home pool/home

\# zfs create pool/home/bob

### Example 2: Disabling and Enabling File System Compression
The following command disables the compression property for all file systems under pool/home. The next command explicitly enables compression for pool/home/anne.

\# zfs set compression=off pool/home

\# zfs set compression=on pool/home/anne

### Example 3: Setting a Quota on a ZFS File System
The following command sets a quota of 50 Gbytes for pool/home/bob:

\# zfs set quota=50G pool/home/bob

### Example 4: Listing ZFS Properties
The following command lists all properties for pool/home/bob:

```
# zfs get all pool/home/bob
NAME           PROPERTY              VALUE                  SOURCE
pool/home/bob  type                  filesystem             -
pool/home/bob  creation              Tue Jul 21 15:53 2009  -
pool/home/bob  used                  21K                    -
pool/home/bob  available             20.0G                  -
pool/home/bob  referenced            21K                    -
pool/home/bob  compressratio         1.00x                  -
pool/home/bob  mounted               yes                    -
pool/home/bob  quota                 20G                    local
pool/home/bob  reservation           none                   default
pool/home/bob  recordsize            128K                   default
pool/home/bob  mountpoint            /pool/home/bob         default
pool/home/bob  sharenfs              off                    default
pool/home/bob  checksum              on                     default
pool/home/bob  compression           on                     local
pool/home/bob  atime                 on                     default
pool/home/bob  devices               on                     default
pool/home/bob  exec                  on                     default
pool/home/bob  setuid                on                     default
pool/home/bob  readonly              off                    default
pool/home/bob  zoned                 off                    default
pool/home/bob  snapdir               hidden                 default
pool/home/bob  acltype               off                    default
pool/home/bob  aclmode               discard                default
pool/home/bob  aclinherit            restricted             default
pool/home/bob  canmount              on                     default
pool/home/bob  xattr                 on                     default
pool/home/bob  copies                1                      default
pool/home/bob  version               4                      -
pool/home/bob  utf8only              off                    -
pool/home/bob  normalization         none                   -
pool/home/bob  casesensitivity       sensitive              -
pool/home/bob  vscan                 off                    default
pool/home/bob  nbmand                off                    default
pool/home/bob  sharesmb              off                    default
pool/home/bob  refquota              none                   default
pool/home/bob  refreservation        none                   default
pool/home/bob  primarycache          all                    default
pool/home/bob  secondarycache        all                    default
pool/home/bob  usedbysnapshots       0                      -
pool/home/bob  usedbydataset         21K                    -
pool/home/bob  usedbychildren        0                      -
pool/home/bob  usedbyrefreservation  0                      -
```

The following command gets a single property value:

```
# zfs get -H -o value compression pool/home/bob
on
```

The following command gets a single property value recursively in JSON format:

```
# zfs get -j -r mountpoint pool/home | jq
{
  "output_version": {
    "command": "zfs get",
    "vers_major": 0,
    "vers_minor": 1
  },
  "datasets": {
    "pool/home": {
      "name": "pool/home",
      "type": "FILESYSTEM",
      "pool": "pool",
      "createtxg": "10",
      "properties": {
        "mountpoint": {
          "value": "/pool/home",
          "source": {
            "type": "DEFAULT",
            "data": "-"
          }
        }
      }
    },
    "pool/home/bob": {
      "name": "pool/home/bob",
      "type": "FILESYSTEM",
      "pool": "pool",
      "createtxg": "1176",
      "properties": {
        "mountpoint": {
          "value": "/pool/home/bob",
          "source": {
            "type": "DEFAULT",
            "data": "-"
          }
        }
      }
    }
  }
}
```

The following command lists all properties with local settings for pool/home/bob:

```
# zfs get -r -s local -o name,property,value all pool/home/bob
NAME           PROPERTY              VALUE
pool/home/bob  quota                 20G
pool/home/bob  compression           on
```

### Example 5: Inheriting ZFS Properties
The following command causes pool/home/bob and pool/home/anne to inherit the checksum property from their parent.

\# zfs inherit checksum pool/home/bob pool/home/anne

### Example 6: Setting User Properties
The following example sets the user-defined com.example:department property for a dataset:

\# zfs set com.example:department=12345 tank/accounting

### Example 7: Setting sharenfs Property Options on a ZFS File System
The following commands show how to set sharenfs property options to enable read-write access for a set of IP addresses and to enable root access for system "neo" on the tank/home file system:

\# zfs set sharenfs='rw=@123.123.0.0/16:[::1],root=neo' tank/home

If you are using DNS for host name resolution, specify the fully-qualified hostname.

## SEE ALSO
zfsprops(7), zfs-list(8)


zfs-groupspace

title: zfs-groupspace(8)

summary: display space and quotas of ZFS dataset

text:
# zfs-groupspace(8)

## NAME
zfs-userspace — display space and quotas of ZFS dataset

## SYNOPSIS
zfs

userspace [-Hinp] [-o field[,field]…] [-s field]… [-S field]… [-t type[,type]…] filesystem|snapshot|path

zfs

groupspace [-Hinp] [-o field[,field]…] [-s field]… [-S field]… [-t type[,type]…] filesystem|snapshot|path

zfs

projectspace [-Hp] [-o field[,field]…] [-s field]… [-S field]… filesystem|snapshot|path

## DESCRIPTION
zfs userspace [-Hinp] [-o field[,field]…] [-s field]… [-S field]… [-t type[,type]…] filesystem|snapshot|path

Displays space consumed by, and quotas on, each user in the specified filesystem, snapshot, or path. If a path is given, the filesystem that contains that path will be used. This corresponds to the userused@user, userobjused@user, userquota@user, and userobjquota@user properties. -H

Do not print headers, use tab-delimited output.

-S field

Sort by this field in reverse order. See -s.

-i

Translate SID to POSIX ID. The POSIX ID may be ephemeral if no mapping exists. Normal POSIX interfaces (like stat(2), ls -l) perform this translation, so the -i option allows the output from zfs userspace to be compared directly with those utilities. However, -i may lead to confusion if some files were created by an SMB user before a SMB-to-POSIX name mapping was established. In such a case, some files will be owned by the SMB entity and some by the POSIX entity. However, the -i option will report that the POSIX entity has the total usage and quota for both.

-n

Print numeric ID instead of user/group name.

-o field[,field]…

Display only the specified fields from the following set: type, name, used, quota. The default is to display all fields.

-p

Use exact (parsable) numeric output.

-s field

Sort output by this field. The -s and -S flags may be specified multiple times to sort first by one field, then by another. The default is -s type -s name.

-t type[,type]…

Print only the specified types from the following set: all, posixuser, smbuser, posixgroup, smbgroup. The default is -t posixuser,smbuser. The default can be changed to include group types.

zfs groupspace [-Hinp] [-o field[,field]…] [-s field]… [-S field]… [-t type[,type]…] filesystem|snapshot

Displays space consumed by, and quotas on, each group in the specified filesystem or snapshot. This subcommand is identical to userspace, except that the default types to display are -t posixgroup,smbgroup.

zfs projectspace [-Hp] [-o field[,field]…] [-s field]… [-S field]… filesystem|snapshot|path

Displays space consumed by, and quotas on, each project in the specified filesystem or snapshot. This subcommand is identical to userspace, except that the project identifier is a numeral, not a name. So need neither the option -i for SID to POSIX ID nor -n for numeric ID, nor -t for types.

## SEE ALSO
zfsprops(7), zfs-set(8)


zfs-hold

title: zfs-hold(8)

text:
# zfs-hold(8)

## NAME
zfs-hold — hold ZFS snapshots to prevent their removal

## SYNOPSIS
zfs

hold [-r] tag snapshot…

zfs

holds [-rHp] snapshot…

zfs

release [-r] tag snapshot…

## DESCRIPTION
zfs hold [-r] tag snapshot…

Adds a single reference, named with the tag argument, to the specified snapshots. Each snapshot has its own tag namespace, and tags must be unique within that space. If a hold exists on a snapshot, attempts to destroy that snapshot by using the zfs destroy command return EBUSY.

-r

Specifies that a hold with the given tag is applied recursively to the snapshots of all descendent file systems.

zfs holds [-rHp] snapshot…

Lists all existing user references for the given snapshot or snapshots. -r

Lists the holds that are set on the named descendent snapshots, in addition to listing the holds on the named snapshot.

-H

Do not print headers, use tab-delimited output.

-p

Prints holds timestamps as Unix epoch timestamps.

zfs release [-r] tag snapshot…

Removes a single reference, named with the tag argument, from the specified snapshot or snapshots. The tag must already exist for each snapshot. If a hold exists on a snapshot, attempts to destroy that snapshot by using the zfs destroy command return EBUSY. -r

Recursively releases a hold with the given tag on the snapshots of all descendent file systems.

## SEE ALSO
zfs-destroy(8)


zfs-inherit

title: zfs-inherit(8)

summary: set properties on ZFS datasets

text:
# zfs-inherit(8)

## NAME
zfs-set — set properties on ZFS datasets

## SYNOPSIS
zfs

set [-u] property=value [property=value]… filesystem|volume|snapshot…

zfs

get [-r|-d depth] [-Hp] [-j [--json-int]] [-o field[,field]…] [-s source[,source]…] [-t type[,type]…] all|property[,property]… [filesystem|volume|snapshot|bookmark]…

zfs

inherit [-rS] property filesystem|volume|snapshot…

## DESCRIPTION
zfs set [-u] property=value [property=value]… filesystem|volume|snapshot…

Only some properties can be edited. See zfsprops(7) for more information on what properties can be set and acceptable values. Numeric values can be specified as exact values, or in a human-readable form with a suffix of B, K, M, G, T, P, E, Z (for bytes, kilobytes, megabytes, gigabytes, terabytes, petabytes, exabytes, or zettabytes, respectively). User properties can be set on snapshots. For more information, see the User Properties section of zfsprops(7). -u

Update mountpoint, sharenfs, sharesmb property but do not mount or share the dataset.

zfs get [-r|-d depth] [-Hp] [-j [--json-int]] [-o field[,field]…] [-s source[,source]…] [-t type[,type]…] all|property[,property]… [filesystem|volume|snapshot|bookmark]…

Displays properties for the given datasets. If no datasets are specified, then the command displays properties for all datasets on the system. For each property, the following columns are displayed: name

Dataset name

property

Property name

value

Property value

source

Property source local, default, inherited, temporary, received, or - (none).

All columns are displayed by default, though this can be controlled by using the -o option. This command takes a comma-separated list of properties as described in the Native Properties and User Properties sections of zfsprops(7).

The value all can be used to display all properties that apply to the given dataset's type (filesystem, volume, snapshot, or bookmark).

-j, --json [--json-int]

Display the output in JSON format. Specify --json-int to display numbers in integer format instead of strings for JSON output.

-H

Display output in a form more easily parsed by scripts. Any headers are omitted, and fields are explicitly separated by a single tab instead of an arbitrary amount of space.

-d depth

Recursively display any children of the dataset, limiting the recursion to depth. A depth of 1 will display only the dataset and its direct children.

-o field

A comma-separated list of columns to display, defaults to name,property,value,source.

-p

Display numbers in parsable (exact) values.

-r

Recursively display properties for any children.

-s source

A comma-separated list of sources to display. Those properties coming from a source other than those in this list are ignored. Each source must be one of the following: local, default, inherited, temporary, received, or none. The default value is all sources.

-t type

A comma-separated list of types to display, where type is one of filesystem, snapshot, volume, bookmark, or all. fs, snap, or vol can be used as aliases for filesystem, snapshot, or volume.

zfs inherit [-rS] property filesystem|volume|snapshot…

Clears the specified property, causing it to be inherited from an ancestor, restored to default if no ancestor has the property set, or with the -S option reverted to the received value if one exists. See zfsprops(7) for a listing of default values, and details on which properties can be inherited. -r

Recursively inherit the given property for all children.

-S

Revert the property to the received value, if one exists; otherwise, for non-inheritable properties, to the default; otherwise, operate as if the -S option was not specified.

## EXAMPLES

### Example 1: Creating a ZFS File System Hierarchy
The following commands create a file system named pool/home and a file system named pool/home/bob. The mount point /export/home is set for the parent file system, and is automatically inherited by the child file system.

\# zfs create pool/home

\# zfs set mountpoint=/export/home pool/home

\# zfs create pool/home/bob

### Example 2: Disabling and Enabling File System Compression
The following command disables the compression property for all file systems under pool/home. The next command explicitly enables compression for pool/home/anne.

\# zfs set compression=off pool/home

\# zfs set compression=on pool/home/anne

### Example 3: Setting a Quota on a ZFS File System
The following command sets a quota of 50 Gbytes for pool/home/bob:

\# zfs set quota=50G pool/home/bob

### Example 4: Listing ZFS Properties
The following command lists all properties for pool/home/bob:

```
# zfs get all pool/home/bob
NAME           PROPERTY              VALUE                  SOURCE
pool/home/bob  type                  filesystem             -
pool/home/bob  creation              Tue Jul 21 15:53 2009  -
pool/home/bob  used                  21K                    -
pool/home/bob  available             20.0G                  -
pool/home/bob  referenced            21K                    -
pool/home/bob  compressratio         1.00x                  -
pool/home/bob  mounted               yes                    -
pool/home/bob  quota                 20G                    local
pool/home/bob  reservation           none                   default
pool/home/bob  recordsize            128K                   default
pool/home/bob  mountpoint            /pool/home/bob         default
pool/home/bob  sharenfs              off                    default
pool/home/bob  checksum              on                     default
pool/home/bob  compression           on                     local
pool/home/bob  atime                 on                     default
pool/home/bob  devices               on                     default
pool/home/bob  exec                  on                     default
pool/home/bob  setuid                on                     default
pool/home/bob  readonly              off                    default
pool/home/bob  zoned                 off                    default
pool/home/bob  snapdir               hidden                 default
pool/home/bob  acltype               off                    default
pool/home/bob  aclmode               discard                default
pool/home/bob  aclinherit            restricted             default
pool/home/bob  canmount              on                     default
pool/home/bob  xattr                 on                     default
pool/home/bob  copies                1                      default
pool/home/bob  version               4                      -
pool/home/bob  utf8only              off                    -
pool/home/bob  normalization         none                   -
pool/home/bob  casesensitivity       sensitive              -
pool/home/bob  vscan                 off                    default
pool/home/bob  nbmand                off                    default
pool/home/bob  sharesmb              off                    default
pool/home/bob  refquota              none                   default
pool/home/bob  refreservation        none                   default
pool/home/bob  primarycache          all                    default
pool/home/bob  secondarycache        all                    default
pool/home/bob  usedbysnapshots       0                      -
pool/home/bob  usedbydataset         21K                    -
pool/home/bob  usedbychildren        0                      -
pool/home/bob  usedbyrefreservation  0                      -
```

The following command gets a single property value:

```
# zfs get -H -o value compression pool/home/bob
on
```

The following command gets a single property value recursively in JSON format:

```
# zfs get -j -r mountpoint pool/home | jq
{
  "output_version": {
    "command": "zfs get",
    "vers_major": 0,
    "vers_minor": 1
  },
  "datasets": {
    "pool/home": {
      "name": "pool/home",
      "type": "FILESYSTEM",
      "pool": "pool",
      "createtxg": "10",
      "properties": {
        "mountpoint": {
          "value": "/pool/home",
          "source": {
            "type": "DEFAULT",
            "data": "-"
          }
        }
      }
    },
    "pool/home/bob": {
      "name": "pool/home/bob",
      "type": "FILESYSTEM",
      "pool": "pool",
      "createtxg": "1176",
      "properties": {
        "mountpoint": {
          "value": "/pool/home/bob",
          "source": {
            "type": "DEFAULT",
            "data": "-"
          }
        }
      }
    }
  }
}
```

The following command lists all properties with local settings for pool/home/bob:

```
# zfs get -r -s local -o name,property,value all pool/home/bob
NAME           PROPERTY              VALUE
pool/home/bob  quota                 20G
pool/home/bob  compression           on
```

### Example 5: Inheriting ZFS Properties
The following command causes pool/home/bob and pool/home/anne to inherit the checksum property from their parent.

\# zfs inherit checksum pool/home/bob pool/home/anne

### Example 6: Setting User Properties
The following example sets the user-defined com.example:department property for a dataset:

\# zfs set com.example:department=12345 tank/accounting

### Example 7: Setting sharenfs Property Options on a ZFS File System
The following commands show how to set sharenfs property options to enable read-write access for a set of IP addresses and to enable root access for system "neo" on the tank/home file system:

\# zfs set sharenfs='rw=@123.123.0.0/16:[::1],root=neo' tank/home

If you are using DNS for host name resolution, specify the fully-qualified hostname.

## SEE ALSO
zfsprops(7), zfs-list(8)


zfs-list

title: zfs-list(8)

summary: list properties of ZFS datasets

text:
# zfs-list(8)

## NAME
zfs-list — list properties of ZFS datasets

## SYNOPSIS
zfs

list [-r|-d depth] [-Hp] [-j [--json-int]] [-o property[,property]…] [-s property]… [-S property]… [-t type[,type]…] [filesystem|volume|snapshot]…

## DESCRIPTION
By default, all file systems and volumes are displayed, with the following fields: name, used, available, referenced, mountpoint. Snapshots are displayed if the listsnapshots pool property is on (the default is off) or if the -t snapshot or -t all options are specified.

-H

Used for scripting mode. Do not print headers, and separate fields by a single tab instead of arbitrary white space.

-j, --json [--json-int]

Print the output in JSON format. Specify --json-int to print the numbers in integer format instead of strings in JSON output.

-d depth

Recursively display any children of the dataset, limiting the recursion to depth. A depth of 1 will display only the dataset and its direct children.

-o property

A comma-separated list of properties to display. Each property must be:

- One of the properties described in the Native Properties section of zfsprops(7)

- A user property

- The value name to display the dataset name

- The value space to display space usage properties on file systems and volumes. This is a shortcut for specifying -o name,avail,used,usedsnap,usedds,usedrefreserv,usedchild -t filesystem,volume.

-p

Display numbers in parsable (exact) values.

-r

Recursively display any children of the dataset on the command line.

-s property

A property for sorting the output by column in ascending order based on the value of the property. The property must be one of the properties described in the Properties section of zfsprops(7) or the value name to sort by the dataset name. Multiple properties can be specified to operate together using multiple -s or -S options. Multiple -s and -S options are evaluated from left to right to supply sort keys in decreasing order of priority. Property types operate as follows:

- Numeric types sort in numeric order.

- String types sort in alphabetical order.

- Types inappropriate for a row sort that row to the literal bottom, regardless of the specified ordering.

If no sort columns are specified, or if two lines of output would sort equally across all specified columns, then datasets and bookmarks are sorted by name, whereas snapshots are sorted first by the name of their dataset and then by the time of their creation. When no sort columns are specified but snapshots are listed, this default behavior causes snapshots to be grouped under their datasets in chronological order by creation time.

-S property

Same as -s, but sorts by property in descending order.

-t type

A comma-separated list of types to display, where type is one of filesystem, snapshot, volume, bookmark, or all. For example, specifying -t snapshot displays only snapshots. fs, snap, or vol can be used as aliases for filesystem, snapshot, or volume.

## EXAMPLES

### Example 1: Listing ZFS Datasets
The following command lists all active file systems and volumes in the system. Snapshots are displayed if listsnaps=on. The default is off. See zpoolprops(7) for more information on pool properties.

```
# zfs list
NAME                      USED  AVAIL  REFER  MOUNTPOINT
pool                      450K   457G    18K  /pool
pool/home                 315K   457G    21K  /export/home
pool/home/anne             18K   457G    18K  /export/home/anne
pool/home/bob             276K   457G   276K  /export/home/bob
```

### Example 2: Listing ZFS filesystems and snapshots in JSON format

```
# zfs list -j -t filesystem,snapshot | jq
{
  "output_version": {
    "command": "zfs list",
    "vers_major": 0,
    "vers_minor": 1
  },
  "datasets": {
    "pool": {
      "name": "pool",
      "type": "FILESYSTEM",
      "pool": "pool",
      "properties": {
        "used": {
          "value": "290K",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "available": {
          "value": "30.5G",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "referenced": {
          "value": "24K",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "mountpoint": {
          "value": "/pool",
          "source": {
            "type": "DEFAULT",
            "data": "-"
          }
        }
      }
    },
    "pool/home": {
      "name": "pool/home",
      "type": "FILESYSTEM",
      "pool": "pool",
      "properties": {
        "used": {
          "value": "48K",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "available": {
          "value": "30.5G",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "referenced": {
          "value": "24K",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "mountpoint": {
          "value": "/mnt/home",
          "source": {
            "type": "LOCAL",
            "data": "-"
          }
        }
      }
    },
    "pool/home/bob": {
      "name": "pool/home/bob",
      "type": "FILESYSTEM",
      "pool": "pool",
      "properties": {
        "used": {
          "value": "24K",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "available": {
          "value": "30.5G",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "referenced": {
          "value": "24K",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "mountpoint": {
          "value": "/mnt/home/bob",
          "source": {
            "type": "INHERITED",
            "data": "pool/home"
          }
        }
      }
    },
    "pool/home/bob@v1": {
      "name": "pool/home/bob@v1",
      "type": "SNAPSHOT",
      "pool": "pool",
      "dataset": "pool/home/bob",
      "snapshot_name": "v1",
      "properties": {
        "used": {
          "value": "0B",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "available": {
          "value": "-",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "referenced": {
          "value": "24K",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        },
        "mountpoint": {
          "value": "-",
          "source": {
            "type": "NONE",
            "data": "-"
          }
        }
      }
    }
  }
}
```

## SEE ALSO
zfsprops(7), zfs-get(8)


zfs-load-key

title: zfs-load-key(8)

text:
# zfs-load-key(8)

## NAME
zfs-load-key — load, unload, or change encryption key of ZFS dataset

## SYNOPSIS
zfs

load-key [-nr] [-L keylocation] -a|filesystem

zfs

unload-key [-r] -a|filesystem

zfs

change-key [-l] [-o keylocation=value] [-o keyformat=value] [-o pbkdf2iters=value] filesystem

zfs

change-key -i [-l] filesystem

## DESCRIPTION
zfs load-key [-nr] [-L keylocation] -a|filesystem

Load the key for filesystem, allowing it and all children that inherit the keylocation property to be accessed. The key will be expected in the format specified by the keyformat and location specified by the keylocation property. Note that if the keylocation is set to prompt the terminal will interactively wait for the key to be entered. Loading a key will not automatically mount the dataset. If that functionality is desired, zfs mount -l will ask for the key and mount the dataset (see zfs-mount(8)). Once the key is loaded the keystatus property will become available. -r

Recursively loads the keys for the specified filesystem and all descendent encryption roots.

-a

Loads the keys for all encryption roots in all imported pools.

-n

Do a dry-run ("No-op") load-key. This will cause zfs to simply check that the provided key is correct. This command may be run even if the key is already loaded.

-L keylocation

Use keylocation instead of the keylocation property. This will not change the value of the property on the dataset. Note that if used with either -r or -a, keylocation may only be given as prompt.

zfs unload-key [-r] -a|filesystem

Unloads a key from ZFS, removing the ability to access the dataset and all of its children that inherit the keylocation property. This requires that the dataset is not currently open or mounted. Once the key is unloaded the keystatus property will become unavailable. -r

Recursively unloads the keys for the specified filesystem and all descendent encryption roots.

-a

Unloads the keys for all encryption roots in all imported pools.

zfs change-key [-l] [-o keylocation=value] [-o keyformat=value] [-o pbkdf2iters=value] filesystem

zfs change-key -i [-l] filesystem

Changes the user's key (e.g. a passphrase) used to access a dataset. This command requires that the existing key for the dataset is already loaded. This command may also be used to change the keylocation, keyformat, and pbkdf2iters properties as needed. If the dataset was not previously an encryption root it will become one. Alternatively, the -i flag may be provided to cause an encryption root to inherit the parent's key instead. If the user's key is compromised, zfs change-key does not necessarily protect existing or newly-written data from attack. Newly-written data will continue to be encrypted with the same master key as the existing data. The master key is compromised if an attacker obtains a user key and the corresponding wrapped master key. Currently, zfs change-key does not overwrite the previous wrapped master key on disk, so it is accessible via forensic analysis for an indeterminate length of time.

In the event of a master key compromise, ideally the drives should be securely erased to remove all the old data (which is readable using the compromised master key), a new pool created, and the data copied back. This can be approximated in place by creating new datasets, copying the data (e.g. using zfs send | zfs recv), and then clearing the free space with zpool trim --secure if supported by your hardware, otherwise zpool initialize.

-l

Ensures the key is loaded before attempting to change the key. This is effectively equivalent to running zfs load-key filesystem; zfs change-key filesystem

-o property=value

Allows the user to set encryption key properties (keyformat, keylocation, and pbkdf2iters) while changing the key. This is the only way to alter keyformat and pbkdf2iters after the dataset has been created.

-i

Indicates that zfs should make filesystem inherit the key of its parent. Note that this command can only be run on an encryption root that has an encrypted parent.

### Encryption
Enabling the encryption feature allows for the creation of encrypted filesystems and volumes. ZFS will encrypt file and volume data, file attributes, ACLs, permission bits, directory listings, FUID mappings, and userused/groupused data. ZFS will not encrypt metadata related to the pool structure, including dataset and snapshot names, dataset hierarchy, properties, file size, file holes, and deduplication tables (though the deduplicated data itself is encrypted).

Key rotation is managed by ZFS. Changing the user's key (e.g. a passphrase) does not require re-encrypting the entire dataset. Datasets can be scrubbed, resilvered, renamed, and deleted without the encryption keys being loaded (see the load-key subcommand for more info on key loading).

Creating an encrypted dataset requires specifying the encryption and keyformat properties at creation time, along with an optional keylocation and pbkdf2iters. After entering an encryption key, the created dataset will become an encryption root. Any descendant datasets will inherit their encryption key from the encryption root by default, meaning that loading, unloading, or changing the key for the encryption root will implicitly do the same for all inheriting datasets. If this inheritance is not desired, simply supply a keyformat when creating the child dataset or use zfs change-key to break an existing relationship, creating a new encryption root on the child. Note that the child's keyformat may match that of the parent while still creating a new encryption root, and that changing the encryption property alone does not create a new encryption root; this would simply use a different cipher suite with the same key as its encryption root. The one exception is that clones will always use their origin's encryption key. As a result of this exception, some encryption-related properties (namely keystatus, keyformat, keylocation, and pbkdf2iters) do not inherit like other ZFS properties and instead use the value determined by their encryption root. Encryption root inheritance can be tracked via the read-only encryptionroot property.

Encryption changes the behavior of a few ZFS operations. Encryption is applied after compression so compression ratios are preserved. Normally checksums in ZFS are 256 bits long, but for encrypted data the checksum is 128 bits of the user-chosen checksum and 128 bits of MAC from the encryption suite, which provides additional protection against maliciously altered data. Deduplication is still possible with encryption enabled but for security, datasets will only deduplicate against themselves, their snapshots, and their clones.

There are a few limitations on encrypted datasets. Encrypted data cannot be embedded via the embedded_data feature. Encrypted datasets may not have copies=3 since the implementation stores some encryption metadata where the third copy would normally be. Since compression is applied before encryption, datasets may be vulnerable to a CRIME-like attack if applications accessing the data allow for it. Deduplication with encryption will leak information about which blocks are equivalent in a dataset and will incur an extra CPU cost for each block written.

## SEE ALSO
zfsprops(7), zfs-create(8), zfs-set(8)


zfs-mount

title: zfs-mount(8)

summary: manage mount state of ZFS filesystems

text:
# zfs-mount(8)

## NAME
zfs-mount — manage mount state of ZFS filesystems

## SYNOPSIS
zfs

mount [-j]

zfs

mount [-Oflv] [-o options] -a|-R filesystem|filesystem

zfs

unmount [-fu] -a|filesystem|mountpoint

## DESCRIPTION
zfs mount [-j]

Displays all ZFS file systems currently mounted. -j, --json

Displays all mounted file systems in JSON format.

zfs mount [-Oflv] [-o options] -a|-R filesystem|filesystem

Mount ZFS filesystem on a path described by its mountpoint property, if the path exists and is empty. If mountpoint is set to legacy, the filesystem should be instead mounted using mount(8). -O

Perform an overlay mount. Allows mounting in non-empty mountpoint. See mount(8) for more information.

-a

Mount all available ZFS file systems. Invoked automatically as part of the boot process if configured.

-R

Mount the specified filesystems along with all their children.

filesystem

Mount the specified filesystem.

-o options

An optional, comma-separated list of mount options to use temporarily for the duration of the mount. See the Temporary Mount Point Properties section of zfsprops(7) for details.

-l

Load keys for encrypted filesystems as they are being mounted. This is equivalent to executing zfs load-key on each encryption root before mounting it. Note that if a filesystem has keylocation=prompt, this will cause the terminal to interactively block after asking for the key.

-v

Report mount progress.

-f

Attempt to force mounting of all filesystems, even those that couldn't normally be mounted (e.g. redacted datasets).

zfs unmount [-fu] -a|filesystem|mountpoint

Unmounts currently mounted ZFS file systems. -a

Unmount all available ZFS file systems. Invoked automatically as part of the shutdown process.

-f

Forcefully unmount the file system, even if it is currently in use. This option is not supported on Linux.

-u

Unload keys for any encryption roots unmounted by this command.

filesystem|mountpoint

Unmount the specified filesystem. The command can also be given a path to a ZFS file system mount point on the system.