Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these template lines ***
I have configured a user 'test1' with a zfs encrypted homedir 'tank/home/test1'

The only thing I'd changed on stock pam configuration was adding option homes=tank/home

When I start a session for test1 via terminal login, su - test1, ssh test1@localhost or graphical login, the homedir is sucessfully mounted and decrypted with the password of test1

When I terminate the terminal or su - session, test1 homedir is umnounted and encryption key is unloaded as expected.

But when I terminate the ssh session an error is thrown:
Jan 13 16:31:01 rpi-400 sshd[2207]: pam_zfs_key(sshd:session): zfs_unmount failed with: -1

test1 homedir is still mounted and readable.
Same problem occurs when terminating a graphical desktop session.

Excpected behaviour: encrypted zfs homedir should be unmounted if there is no sesssion active for test1

Hi Andreas,

aron and I did some investigation. The -1 reported by zfs_umount is actually -EPERM.
This has been discussed by upstream issue #12430.

You may want to try (as workaround):

1. skip pam_zfs_key when pam_systemd is used, as #12430 suggests; or,
2. use `zfs allow` to grant `mount` permission to yourself.

Thanks,
Shengqi Chen

Hi,

I'd like to mention that zfs-allow cannot grant mount/umount
permission on Linux as stated in zfs-allow(8):
       Delegations are supported under Linux with the exception of
       mount, unmount, mountpoint, canmount, rename, and share.
       These permissions cannot be delegated because the Linux
       mount(8) command restricts modifications of the global
       namespace to the root user.

A way to work this around could be to allow zfs commands through
/etc/sudoers.d/zfs configuration, which is commented out on Debian by
default.

Thanks,
Aron