Experimental: Use zfs permissions instead of zfs shell and sudo

README.md

@@ -5,6 +5,18 @@
 | <img width="164" height="164" title="" alt="" src="doc/bitcoin.png" /> |
 | [1Cw9nZu9ygknussPofMWCzmSMveusTbQvN](bitcoin:1Cw9nZu9ygknussPofMWCzmSMveusTbQvN) |
 
+## Experimental version of zfs-tools:
+
+In this experimential version of zfs-tools the "zfs-shell" was removed.
+ZFS permissions should be used instead:
+
+* sender side: zfs allow -u <user> send,snapshot,destroy,mount,hold <source>
+
+* receiver side: zfs allow -u <user> create,mount,receive <destination>
+
+
+## The following documentation needs to be updated:
+
 The ZFS backup tools will help you graft an entire ZFS pool as a filesystem
 into a backup machine, without having to screw around snapshot names or
 complicated shell commands or crontabs.

bin/zbackup

@@ -55,7 +55,7 @@ def zbackup_properties(tier):
 def get_zpools():
     """Return list of zpools."""
     zpools = []
-    zpool_list = subprocess.Popen(["zpool", "list", "-H"], stdout = subprocess.PIPE)
+    zpool_list = subprocess.Popen(["/sbin/zpool", "list", "-H"], stdout = subprocess.PIPE)
     for line in zpool_list.stdout:
         zpools.append(line.split()[0])
     return zpools

debian/changelog

@@ -1,3 +1,9 @@
+zfs-tools (0.6.2) wily; urgency=low
+
+  * remove zfs-shell, zfs user and sudoers rules; use zfs permissions instead
+
+ -- Michael Hierweck <[email protected]>  Thu, 3 Dec 2020 10:14:26 +0000
+
 zfs-tools (0.6.1) wily; urgency=low
 
   * depend on zfsutils-linux

setup.py

@@ -45,7 +45,7 @@
 					]),
 	classifiers = classifiers,
 	packages=["zfstools"],
-	scripts=["bin/zreplicate", 'bin/zfs-shell', 'bin/zsnap', 'bin/zbackup', 'bin/zflock'],
+	scripts=["bin/zreplicate", 'bin/zsnap', 'bin/zbackup', 'bin/zflock'],
 	keywords="ZFS filesystems backup synchronization snapshot",
 	zip_safe=False,
 )

src/zfstools/connection.py

@@ -59,25 +59,25 @@ def __init__(self,host="localhost", trust=False, sshcipher=None, properties=None
     def _get_poolset(self):
         if self._dirty:
             properties = [ 'creation' ] + self._properties
-            stdout2 = subprocess.check_output(self.command + ["zfs", "list", "-Hpr", "-o", ",".join( ['name'] + properties ), "-t", "all"])
+            stdout2 = subprocess.check_output(self.command + ["/sbin/zfs", "list", "-Hpr", "-o", ",".join( ['name'] + properties ), "-t", "all"])
             self._poolset.parse_zfs_r_output(stdout2,properties)
             self._dirty = False
         return self._poolset
     pools = property(_get_poolset)
 
     def create_dataset(self,name):
-        subprocess.check_call(self.command + ["zfs", "create", name])
+        subprocess.check_call(self.command + ["/sbin/zfs", "create", name])
         self._dirty = True
         return self.pools.lookup(name)
 
     def destroy_dataset(self, name):
-        subprocess.check_call(self.command + ["zfs", "destroy", name])
+        subprocess.check_call(self.command + ["/sbin/zfs", "destroy", name])
         self._dirty = True
 
     def destroy_recursively(self, name, returnok=False):
         """If returnok, then simply return success as a boolean."""
         ok = True
-        cmd = self.command + ["zfs", "destroy", '-r', name]
+        cmd = self.command + ["/sbin/zfs", "destroy", '-r', name]
         if returnok:
             ok = subprocess.call(cmd) == 0
         else:
@@ -87,7 +87,7 @@ def destroy_recursively(self, name, returnok=False):
 
     def snapshot_recursively(self,name,snapshotname,properties={}):
         plist = sum( map( lambda x: ['-o', '%s=%s' % x ], properties.items() ), [] )
-        subprocess.check_call(self.command + ["zfs", "snapshot", "-r" ] + plist + [ "%s@%s" % (name, snapshotname)])
+        subprocess.check_call(self.command + ["/sbin/zfs", "snapshot", "-r" ] + plist + [ "%s@%s" % (name, snapshotname)])
         self._dirty = True
 
     def send(self,name,opts=None,bufsize=-1,compression=False,lockdataset=None):
@@ -99,8 +99,8 @@ def send(self,name,opts=None,bufsize=-1,compression=False,lockdataset=None):
             if self.verbose:
                 cmd += ["-v"]
             cmd += [lockdataset, "--"]
-        cmd += ["zfs", "send"] + opts + [name]
-        p = SpecialPopen(cmd,stdin=file(os.devnull),stdout=subprocess.PIPE,bufsize=bufsize)
+        cmd += ["/sbin/zfs", "send"] + opts + [name]
+        p = SpecialPopen(cmd,stdin=open(os.devnull),stdout=subprocess.PIPE,bufsize=bufsize)
         return p
 
     def receive(self,name,pipe,opts=None,bufsize=-1,compression=False,lockdataset=None):
@@ -112,7 +112,7 @@ def receive(self,name,pipe,opts=None,bufsize=-1,compression=False,lockdataset=No
             if self.verbose:
                 cmd += ["-v"]
             cmd += [lockdataset, "--"]
-        cmd = cmd + ["zfs", "receive"] + opts + [name]
+        cmd = cmd + ["/sbin/zfs", "receive"] + opts + [name]
         p = SpecialPopen(cmd,stdin=pipe,bufsize=bufsize)
         return p