Zfs: Support ZFS delegations

[behlendorf]

The 'zfs allow' code which can be used to delegate functionality relies on the zfssecpolicy* hooks being cleanly implemented to limit access accordingly. This work still must be completed in issue #228 before this will work properly.

Secondly, because we are using a mount.zfs helper to mount the filesystem through /bin/mount it's difficult to allow non-root processes to mount. The standard /bin/mount tool expects root and only root to be able to do certain things. A solution needs to be found for this still.

[jgoerzen]

One comment: backup tools such as zetaback wouldn't have to run as root if this were implemented.

[pavel-odintsov]

Want this for ability to delegate "snapshot create" ability and to containers :)

[MoritzMaxeiner]

Since I don't want to open another issue, if it is a duplicate: Would this - if implemented - allow me to effectively "give" a dataset (recursively) to a user?
Essentially the use case would be this:
Given a pool tank with the dataset tank/home mounted to /home, create and give to user foo the dataset tank/home/foo. User foo may now set/get properties ontank/home/foo and create sub datasets like tank/home/foo/lxc (implicitly owned by foo); this goal would be to have unprivileged LXC containers on datasets 'owned' by the user managing the LXC containers, so adding a new unprivileged user and giving him a new dataset as home would immediately enable the user to run unprivileged LXC containers, each on its own dataset, complete with snapshots, deduplication (if enabled), etc.

[behlendorf]

@Calrama yes, that's the basic idea.

[kaazoo]

Will this feature be included in the 0.6.5.8 or 0.7.0 milestone?

[behlendorf]

0.7.0.

[kenthinson]

@behlendorf Does 0.7.0 rc4 have this implemented? thanks!

[behlendorf]

@kenthinson yes, it's there.