summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--sbin/geom/class/eli/geli.844
-rw-r--r--sbin/geom/class/eli/geom_eli.c83
-rw-r--r--tools/regression/geom_eli/attach-d.t2
-rw-r--r--tools/regression/geom_eli/configure-b-B.t4
-rw-r--r--tools/regression/geom_eli/delkey.t2
-rw-r--r--tools/regression/geom_eli/detach-l.t2
-rw-r--r--tools/regression/geom_eli/init-B.t106
-rw-r--r--tools/regression/geom_eli/init-a.t2
-rw-r--r--tools/regression/geom_eli/init-i-P.t2
-rw-r--r--tools/regression/geom_eli/init.t2
-rw-r--r--tools/regression/geom_eli/integrity-copy.t2
-rw-r--r--tools/regression/geom_eli/integrity-data.t2
-rw-r--r--tools/regression/geom_eli/integrity-hmac.t2
-rw-r--r--tools/regression/geom_eli/kill.t4
-rw-r--r--tools/regression/geom_eli/nokey.t4
-rw-r--r--tools/regression/geom_eli/readonly.t2
-rw-r--r--tools/regression/geom_eli/setkey.t2
17 files changed, 233 insertions, 34 deletions
diff --git a/sbin/geom/class/eli/geli.8 b/sbin/geom/class/eli/geli.8
index 280962a..a39a601 100644
--- a/sbin/geom/class/eli/geli.8
+++ b/sbin/geom/class/eli/geli.8
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2005-2006 Pawel Jakub Dawidek <pjd@FreeBSD.org>
+.\" Copyright (c) 2005-2008 Pawel Jakub Dawidek <pjd@FreeBSD.org>
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
@@ -24,7 +24,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd September 16, 2006
+.Dd August 29, 2008
.Dt GELI 8
.Os
.Sh NAME
@@ -53,6 +53,7 @@ utility:
.Cm init
.Op Fl bPv
.Op Fl a Ar aalgo
+.Op Fl B Ar backupfile
.Op Fl e Ar ealgo
.Op Fl i Ar iterations
.Op Fl K Ar newkeyfile
@@ -206,6 +207,14 @@ indicates an action to be performed:
Initialize provider which needs to be encrypted.
Here you can set up the cryptographic algorithm to use, key length, etc.
The last provider's sector is used to store metadata.
+The
+.Cm init
+subcommand also automatically backups metadata in
+.Pa /var/backups/<prov>.eli
+file.
+The metadata can be recovered with the
+.Cm restore
+subcommand described below.
.Pp
Additional options include:
.Bl -tag -width ".Fl a Ar aalgo"
@@ -233,6 +242,13 @@ One will still need bootable unencrypted storage with a
.Pa /boot/
directory, which can be a CD-ROM disc or USB pen-drive, that can be removed
after boot.
+.It Fl B Ar backupfile
+File name to use for metadata backup instead of the default
+.Pa /var/backups/<prov>.eli .
+To inhibit backups, you can use
+.Pa none
+as the
+.Ar backupfile .
.It Fl e Ar ealgo
Encryption algorithm to use.
Currently supported algorithms are:
@@ -625,6 +641,30 @@ Enter passphrase:
# newfs /dev/da0.eli
# mount /dev/da0.eli /mnt/secret
.Ed
+.Pp
+.Cm geli
+backups metadata by default to the
+.Pa /var/backups/<prov>.eli
+file.
+If metadata is lost in any way (eg. by accidental overwrite), it can be restored.
+Consider the following situation:
+.Bd -literal -offset indent
+# geli init /dev/da0
+Enter new passphrase:
+Reenter new passphrase:
+
+Metadata backup can be found in /var/backups/da0.eli and
+can be restored with the following command:
+
+ # geli restore /var/backups/da0.eli /dev/da0
+
+# geli clear /dev/da0
+# geli attach /dev/da0
+geli: Cannot read metadata from /dev/da0: Invalid argument.
+# geli restore /var/backups/da0.eli /dev/da0
+# geli attach /dev/da0
+Enter passphrase:
+.Ed
.Sh DATA AUTHENTICATION
.Nm
can verify data integrity when an authentication algorithm is specified.
diff --git a/sbin/geom/class/eli/geom_eli.c b/sbin/geom/class/eli/geom_eli.c
index 2e16103..d772a9a 100644
--- a/sbin/geom/class/eli/geom_eli.c
+++ b/sbin/geom/class/eli/geom_eli.c
@@ -1,5 +1,5 @@
/*-
- * Copyright (c) 2004-2006 Pawel Jakub Dawidek <pjd@FreeBSD.org>
+ * Copyright (c) 2004-2008 Pawel Jakub Dawidek <pjd@FreeBSD.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
@@ -54,6 +54,8 @@ __FBSDID("$FreeBSD$");
uint32_t lib_version = G_LIB_VERSION;
uint32_t version = G_ELI_VERSION;
+#define GELI_BACKUP_DIR "/var/backups/"
+
static char aalgo[] = "none";
static char ealgo[] = "aes";
static intmax_t keylen = 0;
@@ -61,6 +63,7 @@ static intmax_t keyno = -1;
static intmax_t iterations = -1;
static intmax_t sectorsize = 0;
static char keyfile[] = "", newkeyfile[] = "";
+static char backupfile[] = "";
static void eli_main(struct gctl_req *req, unsigned flags);
static void eli_init(struct gctl_req *req);
@@ -74,10 +77,13 @@ static void eli_restore(struct gctl_req *req);
static void eli_clear(struct gctl_req *req);
static void eli_dump(struct gctl_req *req);
+static int eli_backup_create(struct gctl_req *req, const char *prov,
+ const char *file);
+
/*
* Available commands:
*
- * init [-bhPv] [-a aalgo] [-e ealgo] [-i iterations] [-l keylen] [-K newkeyfile] prov
+ * init [-bhPv] [-a aalgo] [-B backupfile] [-e ealgo] [-i iterations] [-l keylen] [-K newkeyfile] prov
* label - alias for 'init'
* attach [-dprv] [-k keyfile] prov
* detach [-fl] prov ...
@@ -97,6 +103,7 @@ struct g_command class_commands[] = {
{
{ 'a', "aalgo", aalgo, G_TYPE_STRING },
{ 'b', "boot", NULL, G_TYPE_BOOL },
+ { 'B', "backupfile", backupfile, G_TYPE_STRING },
{ 'e', "ealgo", ealgo, G_TYPE_STRING },
{ 'i', "iterations", &iterations, G_TYPE_NUMBER },
{ 'K', "newkeyfile", newkeyfile, G_TYPE_STRING },
@@ -105,12 +112,13 @@ struct g_command class_commands[] = {
{ 's', "sectorsize", &sectorsize, G_TYPE_NUMBER },
G_OPT_SENTINEL
},
- NULL, "[-bPv] [-a aalgo] [-e ealgo] [-i iterations] [-l keylen] [-K newkeyfile] [-s sectorsize] prov"
+ NULL, "[-bPv] [-a aalgo] [-B backupfile] [-e ealgo] [-i iterations] [-l keylen] [-K newkeyfile] [-s sectorsize] prov"
},
{ "label", G_FLAG_VERBOSE, eli_main,
{
{ 'a', "aalgo", aalgo, G_TYPE_STRING },
{ 'b', "boot", NULL, G_TYPE_BOOL },
+ { 'B', "backupfile", backupfile, G_TYPE_STRING },
{ 'e', "ealgo", ealgo, G_TYPE_STRING },
{ 'i', "iterations", &iterations, G_TYPE_NUMBER },
{ 'K', "newkeyfile", newkeyfile, G_TYPE_STRING },
@@ -514,6 +522,7 @@ eli_init(struct gctl_req *req)
struct g_eli_metadata md;
unsigned char sector[sizeof(struct g_eli_metadata)];
unsigned char key[G_ELI_USERKEYLEN];
+ char backfile[MAXPATHLEN];
const char *str, *prov;
unsigned secsize;
off_t mediasize;
@@ -648,6 +657,32 @@ eli_init(struct gctl_req *req)
}
if (verbose)
printf("Metadata value stored on %s.\n", prov);
+ /* Backup metadata to a file. */
+ str = gctl_get_ascii(req, "backupfile");
+ if (str[0] != '\0') {
+ /* Backupfile given be the user, just copy it. */
+ strlcpy(backfile, str, sizeof(backfile));
+ } else {
+ /* Generate file name automatically. */
+ const char *p = prov;
+ unsigned int i;
+
+ if (strncmp(p, _PATH_DEV, strlen(_PATH_DEV)) == 0)
+ p += strlen(_PATH_DEV);
+ snprintf(backfile, sizeof(backfile), "%s%s.eli",
+ GELI_BACKUP_DIR, p);
+ /* Replace all / with _. */
+ for (i = strlen(GELI_BACKUP_DIR); backfile[i] != '\0'; i++) {
+ if (backfile[i] == '/')
+ backfile[i] = '_';
+ }
+ }
+ if (strcmp(backfile, "none") != 0 &&
+ eli_backup_create(req, prov, backfile) == 0) {
+ printf("\nMetadata backup can be found in %s and\n", backfile);
+ printf("can be restored with the following command:\n");
+ printf("\n\t# geli restore %s %s\n\n", backfile, prov);
+ }
}
static void
@@ -887,6 +922,12 @@ eli_setkey(struct gctl_req *req)
eli_setkey_attached(req, &md);
else
eli_setkey_detached(req, prov, &md);
+
+ if (req->error == NULL || req->error[0] == '\0') {
+ printf("Note, that the master key encrypted with old keys "
+ "and/or passphrase may still exists in a metadata backup "
+ "file.\n");
+ }
}
static void
@@ -1022,24 +1063,16 @@ eli_kill(struct gctl_req *req)
gctl_issue(req);
}
-static void
-eli_backup(struct gctl_req *req)
+static int
+eli_backup_create(struct gctl_req *req, const char *prov, const char *file)
{
struct g_eli_metadata md;
- const char *file, *prov;
unsigned secsize;
unsigned char *sector;
off_t mediasize;
- int nargs, filefd, provfd;
-
- nargs = gctl_get_int(req, "nargs");
- if (nargs != 2) {
- gctl_error(req, "Invalid number of arguments.");
- return;
- }
- prov = gctl_get_ascii(req, "arg0");
- file = gctl_get_ascii(req, "arg1");
+ int filefd, provfd, ret;
+ ret = -1;
provfd = filefd = -1;
sector = NULL;
secsize = 0;
@@ -1092,6 +1125,8 @@ eli_backup(struct gctl_req *req)
strerror(errno));
goto out;
}
+ /* Success. */
+ ret = 0;
out:
if (provfd > 0)
close(provfd);
@@ -1101,6 +1136,24 @@ out:
bzero(sector, secsize);
free(sector);
}
+ return (ret);
+}
+
+static void
+eli_backup(struct gctl_req *req)
+{
+ const char *file, *prov;
+ int nargs;
+
+ nargs = gctl_get_int(req, "nargs");
+ if (nargs != 2) {
+ gctl_error(req, "Invalid number of arguments.");
+ return;
+ }
+ prov = gctl_get_ascii(req, "arg0");
+ file = gctl_get_ascii(req, "arg1");
+
+ eli_backup_create(req, prov, file);
}
static void
diff --git a/tools/regression/geom_eli/attach-d.t b/tools/regression/geom_eli/attach-d.t
index de4602f..4c4789e 100644
--- a/tools/regression/geom_eli/attach-d.t
+++ b/tools/regression/geom_eli/attach-d.t
@@ -11,7 +11,7 @@ echo "1..3"
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
-geli init -P -K $keyfile md${no}
+geli init -B none -P -K $keyfile md${no}
geli attach -d -p -k $keyfile md${no}
if [ -c /dev/md${no}.eli ]; then
echo "ok 1"
diff --git a/tools/regression/geom_eli/configure-b-B.t b/tools/regression/geom_eli/configure-b-B.t
index b58138b..23aa412 100644
--- a/tools/regression/geom_eli/configure-b-B.t
+++ b/tools/regression/geom_eli/configure-b-B.t
@@ -8,7 +8,7 @@ mdconfig -a -t malloc -s `expr $sectors + 1` -u $no || exit 1
echo "1..17"
-geli init -P -K /dev/null md${no}
+geli init -B none -P -K /dev/null md${no}
if [ $? -eq 0 ]; then
echo "ok 1"
else
@@ -22,7 +22,7 @@ else
echo "not ok 2"
fi
-geli init -b -P -K /dev/null md${no}
+geli init -B none -b -P -K /dev/null md${no}
if [ $? -eq 0 ]; then
echo "ok 3"
else
diff --git a/tools/regression/geom_eli/delkey.t b/tools/regression/geom_eli/delkey.t
index 2a9ae40..a828622 100644
--- a/tools/regression/geom_eli/delkey.t
+++ b/tools/regression/geom_eli/delkey.t
@@ -17,7 +17,7 @@ dd if=/dev/random of=${keyfile2} bs=512 count=16 >/dev/null 2>&1
dd if=/dev/random of=${keyfile3} bs=512 count=16 >/dev/null 2>&1
dd if=/dev/random of=${keyfile4} bs=512 count=16 >/dev/null 2>&1
-geli init -P -K $keyfile1 md${no}
+geli init -B none -P -K $keyfile1 md${no}
geli attach -p -k $keyfile1 md${no}
geli setkey -n 1 -P -K $keyfile2 md${no}
diff --git a/tools/regression/geom_eli/detach-l.t b/tools/regression/geom_eli/detach-l.t
index ae6c3b2..dfa3269 100644
--- a/tools/regression/geom_eli/detach-l.t
+++ b/tools/regression/geom_eli/detach-l.t
@@ -11,7 +11,7 @@ echo "1..4"
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
-geli init -P -K $keyfile md${no}
+geli init -B none -P -K $keyfile md${no}
geli attach -p -k $keyfile md${no}
if [ -c /dev/md${no}.eli ]; then
echo "ok 1"
diff --git a/tools/regression/geom_eli/init-B.t b/tools/regression/geom_eli/init-B.t
new file mode 100644
index 0000000..36ab873
--- /dev/null
+++ b/tools/regression/geom_eli/init-B.t
@@ -0,0 +1,106 @@
+#!/bin/sh
+# $FreeBSD$
+
+base=`basename $0`
+no=45
+sectors=100
+keyfile=`mktemp /tmp/$base.XXXXXX` || exit 1
+backupfile=`mktemp /tmp/$base.XXXXXX` || exit 1
+
+echo "1..13"
+
+dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
+
+mdconfig -a -t malloc -s $sectors -u $no || exit 1
+
+# -B none
+rm -f /var/backups/md${no}.eli
+geli init -B none -P -K $keyfile md${no} 2>/dev/null
+if [ ! -f /var/backups/md${no}.eli ]; then
+ echo "ok 1 - -B none"
+else
+ echo "not ok 1 - -B none"
+fi
+
+# no -B
+rm -f /var/backups/md${no}.eli
+geli init -P -K $keyfile md${no} >/dev/null 2>&1
+if [ -f /var/backups/md${no}.eli ]; then
+ echo "ok 2 - no -B"
+else
+ echo "not ok 2 - no -B"
+fi
+geli clear md${no}
+geli attach -p -k $keyfile md${no} 2>/dev/null
+if [ $? -ne 0 ]; then
+ echo "ok 3 - no -B"
+else
+ echo "not ok 3 - no -B"
+fi
+if [ ! -c /dev/md${no}.eli ]; then
+ echo "ok 4 - no -B"
+else
+ echo "not ok 4 - no -B"
+fi
+geli restore /var/backups/md${no}.eli md${no}
+if [ $? -eq 0 ]; then
+ echo "ok 5 - no -B"
+else
+ echo "not ok 5 - no -B"
+fi
+geli attach -p -k $keyfile md${no} 2>/dev/null
+if [ $? -eq 0 ]; then
+ echo "ok 6 - no -B"
+else
+ echo "not ok 6 - no -B"
+fi
+if [ -c /dev/md${no}.eli ]; then
+ echo "ok 7 - no -B"
+else
+ echo "not ok 7 - no -B"
+fi
+geli detach md${no}
+rm -f /var/backups/md${no}.eli
+
+# -B file
+rm -f $backupfile
+geli init -B $backupfile -P -K $keyfile md${no} >/dev/null 2>&1
+if [ -f $backupfile ]; then
+ echo "ok 8 - -B file"
+else
+ echo "not ok 8 - -B file"
+fi
+geli clear md${no}
+geli attach -p -k $keyfile md${no} 2>/dev/null
+if [ $? -ne 0 ]; then
+ echo "ok 9 - -B file"
+else
+ echo "not ok 9 - -B file"
+fi
+if [ ! -c /dev/md${no}.eli ]; then
+ echo "ok 10 - -B file"
+else
+ echo "not ok 10 - -B file"
+fi
+geli restore $backupfile md${no}
+if [ $? -eq 0 ]; then
+ echo "ok 11 - -B file"
+else
+ echo "not ok 11 - -B file"
+fi
+geli attach -p -k $keyfile md${no} 2>/dev/null
+if [ $? -eq 0 ]; then
+ echo "ok 12 - -B file"
+else
+ echo "not ok 12 - -B file"
+fi
+if [ -c /dev/md${no}.eli ]; then
+ echo "ok 13 - -B file"
+else
+ echo "not ok 13 - -B file"
+fi
+geli detach md${no}
+rm -f $backupfile
+
+mdconfig -d -u $no
+rm -f $keyfile
diff --git a/tools/regression/geom_eli/init-a.t b/tools/regression/geom_eli/init-a.t
index b8024a7..ace195f 100644
--- a/tools/regression/geom_eli/init-a.t
+++ b/tools/regression/geom_eli/init-a.t
@@ -24,7 +24,7 @@ for cipher in aes:0 aes:128 aes:192 aes:256 \
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
- geli init -a $aalgo -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
+ geli init -B none -a $aalgo -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
geli attach -p -k $keyfile md${no}
secs=`diskinfo /dev/md${no}.eli | awk '{print $4}'`
diff --git a/tools/regression/geom_eli/init-i-P.t b/tools/regression/geom_eli/init-i-P.t
index a77c1c6..a06f9f8 100644
--- a/tools/regression/geom_eli/init-i-P.t
+++ b/tools/regression/geom_eli/init-i-P.t
@@ -11,7 +11,7 @@ echo "1..1"
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
-geli init -i 64 -P -K ${keyfile} md${no} 2>/dev/null
+geli init -B none -i 64 -P -K ${keyfile} md${no} 2>/dev/null
if [ $? -ne 0 ]; then
echo "ok 1"
else
diff --git a/tools/regression/geom_eli/init.t b/tools/regression/geom_eli/init.t
index 518108c..9e796c3 100644
--- a/tools/regression/geom_eli/init.t
+++ b/tools/regression/geom_eli/init.t
@@ -23,7 +23,7 @@ for cipher in aes:0 aes:128 aes:192 aes:256 \
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
- geli init -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
+ geli init -B none -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
geli attach -p -k $keyfile md${no}
secs=`diskinfo /dev/md${no}.eli | awk '{print $4}'`
diff --git a/tools/regression/geom_eli/integrity-copy.t b/tools/regression/geom_eli/integrity-copy.t
index f641bda..a52325c 100644
--- a/tools/regression/geom_eli/integrity-copy.t
+++ b/tools/regression/geom_eli/integrity-copy.t
@@ -25,7 +25,7 @@ for cipher in aes:0 aes:128 aes:192 aes:256 \
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
- geli init -a $aalgo -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
+ geli init -B none -a $aalgo -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
geli attach -p -k $keyfile md${no}
dd if=/dev/random of=/dev/md${no}.eli bs=${secsize} count=1 >/dev/null 2>&1
diff --git a/tools/regression/geom_eli/integrity-data.t b/tools/regression/geom_eli/integrity-data.t
index 9774c7c..712f029 100644
--- a/tools/regression/geom_eli/integrity-data.t
+++ b/tools/regression/geom_eli/integrity-data.t
@@ -24,7 +24,7 @@ for cipher in aes:0 aes:128 aes:192 aes:256 \
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
- geli init -a $aalgo -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
+ geli init -B none -a $aalgo -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
geli attach -p -k $keyfile md${no}
dd if=/dev/random of=/dev/md${no}.eli bs=${secsize} count=1 >/dev/null 2>&1
diff --git a/tools/regression/geom_eli/integrity-hmac.t b/tools/regression/geom_eli/integrity-hmac.t
index b58c37f..46900f3 100644
--- a/tools/regression/geom_eli/integrity-hmac.t
+++ b/tools/regression/geom_eli/integrity-hmac.t
@@ -24,7 +24,7 @@ for cipher in aes:0 aes:128 aes:192 aes:256 \
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
- geli init -a $aalgo -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
+ geli init -B none -a $aalgo -e $ealgo -l $keylen -P -K $keyfile -s $secsize md${no} 2>/dev/null
geli attach -p -k $keyfile md${no}
dd if=/dev/random of=/dev/md${no}.eli bs=${secsize} count=1 >/dev/null 2>&1
diff --git a/tools/regression/geom_eli/kill.t b/tools/regression/geom_eli/kill.t
index ecd910a..5c315f3 100644
--- a/tools/regression/geom_eli/kill.t
+++ b/tools/regression/geom_eli/kill.t
@@ -13,7 +13,7 @@ echo "1..9"
dd if=/dev/random of=${keyfile1} bs=512 count=16 >/dev/null 2>&1
dd if=/dev/random of=${keyfile2} bs=512 count=16 >/dev/null 2>&1
-geli init -P -K $keyfile1 md${no}
+geli init -B none -P -K $keyfile1 md${no}
geli attach -p -k $keyfile1 md${no}
geli setkey -n 1 -P -K $keyfile2 md${no}
@@ -48,7 +48,7 @@ else
echo "not ok 4"
fi
-geli init -P -K $keyfile1 md${no}
+geli init -B none -P -K $keyfile1 md${no}
geli setkey -n 1 -p -k $keyfile1 -P -K $keyfile2 md${no}
# Should be possible to attach with keyfile1.
diff --git a/tools/regression/geom_eli/nokey.t b/tools/regression/geom_eli/nokey.t
index c2cbecd..19ef680 100644
--- a/tools/regression/geom_eli/nokey.t
+++ b/tools/regression/geom_eli/nokey.t
@@ -9,7 +9,7 @@ mdconfig -a -t malloc -s `expr $sectors + 1` -u $no || exit 1
echo "1..8"
-geli init -P md${no} 2>/dev/null
+geli init -B none -P md${no} 2>/dev/null
if [ $? -ne 0 ]; then
echo "ok 1"
else
@@ -18,7 +18,7 @@ fi
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
-geli init -P -K ${keyfile} md${no} 2>/dev/null
+geli init -B none -P -K ${keyfile} md${no} 2>/dev/null
if [ $? -eq 0 ]; then
echo "ok 2"
else
diff --git a/tools/regression/geom_eli/readonly.t b/tools/regression/geom_eli/readonly.t
index f92e934..210a364 100644
--- a/tools/regression/geom_eli/readonly.t
+++ b/tools/regression/geom_eli/readonly.t
@@ -11,7 +11,7 @@ echo "1..11"
dd if=/dev/random of=${keyfile} bs=512 count=16 >/dev/null 2>&1
-geli init -P -K $keyfile md${no}
+geli init -B none -P -K $keyfile md${no}
if [ $? -eq 0 ]; then
echo "ok 1"
else
diff --git a/tools/regression/geom_eli/setkey.t b/tools/regression/geom_eli/setkey.t
index a219188..611471a 100644
--- a/tools/regression/geom_eli/setkey.t
+++ b/tools/regression/geom_eli/setkey.t
@@ -22,7 +22,7 @@ dd if=/dev/random of=${keyfile3} bs=512 count=16 >/dev/null 2>&1
dd if=/dev/random of=${keyfile4} bs=512 count=16 >/dev/null 2>&1
dd if=/dev/random of=${keyfile5} bs=512 count=16 >/dev/null 2>&1
-geli init -P -K $keyfile1 md${no}
+geli init -B none -P -K $keyfile1 md${no}
geli attach -p -k $keyfile1 md${no}
dd if=${rnd} of=/dev/md${no}.eli bs=512 count=${sectors} 2>/dev/null
OpenPOWER on IntegriCloud