Ideals:
-
protection of home directories should be better than in Lion (for multiple administrators: FileVault 2 alone is less secure than FileVault 1)
-
resizing a file system should be simple and nondestructive.
I'll begin with an answer should be good for released and beta builds of ZEVO on OS X 10.7.4. It does not meet the ideals above, but it's food for thought.
Wish for Mountain Lion and greater versions of OS X to offer better support in these areas.
Answers may be added or improved after any of the following:
- release of OS X 10.8
- improvements to ZEVO
- improvements to ZFS (encrypting ZFS is currently limited to Oracle Solaris).
Best Answer
OS X 10.7.4 Core Storage for encryption, ZEVO for ZFS
Example
Objective: one physical disk, five volumes. One of five non-encrypted, one encrypted with a passphrase, three encrypted with a different passphrase.
Starting point:
Hints
Since HFS+ has a single global lock for all metadata updates (held across the I/O) it is highly sensitive to disk latencies. So whilst the mixture of ZFS with JHFS+ on a single disk is possible, for most use cases the file system mixture is not recommended.
This example also makes some use of compression, and of child file systems.
Summary of commands
The output, in Terminal
At this point, with all volumes of the physical disk unmounted, you can disconnect the disk. Reconnection should allow use of the child file systems:
The end result, in Finder
Known issues
In CoreStorage world the content hint
Apple_HFS
will be not true for theZFS
end result. I have asked Apple to allow a more suitable hint.At unlock time, the system may appear to reject the passphrase (maybe because of the content hint mismatch). When rejection appears:
If you wish, use Keychain Access to add to a keychain the passphrase for the UUID of a Core Storage logical volume.
Mountain Lion no longer supports
diskutil eraseDisk
placement of partition maps on Core Storage logical volumes –– thanks to mgrosman for the alert.
Repairs
Considering Apple's design of Core Storage to work primarily with content hint
Apple_HFS
, and the bugs in fsck_cs:ZFS
,zfs_pool_proxy
,zfs_filesystem_proxy
and so on) might impair the ability offsck_cs
to effect repairs in case of difficulty.Proceed with caution.