delegate: add 'send:encrypted' permission

send:encrypted is like send:raw, but only permits encrypted datasets to
be sent - raw send is not permitted for unencrypted datasets.

This commit creates the permission, wires it up, and adds the check for
it in zfs_secpolicy_send_impl(), if it is the last send permission
standing, the dataset is checked for its encryption state.

Sponsored-by: TrueNAS
Reviewed-by: Alexander Motin <[email protected]>
Reviewed-by: Brian Behlendorf <[email protected]>
Signed-off-by: Rob Norris <[email protected]>
Closes #18673

cmd/zfs/zfs_main.c

@@ -33,6 +33,7 @@
  * Copyright 2019 Joyent, Inc.
  * Copyright (c) 2019, 2020 by Christian Schwarz. All rights reserved.
  * Copyright 2026 Oxide Computer Company
+ * Copyright (c) 2026, TrueNAS.
  */
 
 #include <assert.h>
@@ -5361,6 +5362,7 @@ zfs_do_receive(int argc, char **argv)
 #define	ZFS_DELEG_PERM_SHARE		"share"
 #define	ZFS_DELEG_PERM_SEND		"send"
 #define	ZFS_DELEG_PERM_SEND_RAW		"send:raw"
+#define	ZFS_DELEG_PERM_SEND_ENCRYPTED	"send:encrypted"
 #define	ZFS_DELEG_PERM_RECEIVE		"receive"
 #define	ZFS_DELEG_PERM_RECEIVE_APPEND	"receive:append"
 #define	ZFS_DELEG_PERM_ALLOW		"allow"
@@ -5404,6 +5406,7 @@ static zfs_deleg_perm_tab_t zfs_deleg_perm_tbl[] = {
 	{ ZFS_DELEG_PERM_ROLLBACK, ZFS_DELEG_NOTE_ROLLBACK },
 	{ ZFS_DELEG_PERM_SEND, ZFS_DELEG_NOTE_SEND },
 	{ ZFS_DELEG_PERM_SEND_RAW, ZFS_DELEG_NOTE_SEND_RAW },
+	{ ZFS_DELEG_PERM_SEND_ENCRYPTED, ZFS_DELEG_NOTE_SEND_ENCRYPTED },
 	{ ZFS_DELEG_PERM_SHARE, ZFS_DELEG_NOTE_SHARE },
 	{ ZFS_DELEG_PERM_SNAPSHOT, ZFS_DELEG_NOTE_SNAPSHOT },
 	{ ZFS_DELEG_PERM_BOOKMARK, ZFS_DELEG_NOTE_BOOKMARK },
@@ -5902,11 +5905,15 @@ deleg_perm_comment(zfs_deleg_note_t note)
 		str = gettext("");
 		break;
 	case ZFS_DELEG_NOTE_SEND:
-		str = gettext("");
+		str = gettext("Allow sending datasets");
 		break;
 	case ZFS_DELEG_NOTE_SEND_RAW:
-		str = gettext("Allow sending ONLY encrypted (raw) replication"
-		    "\n\t\t\t\tstreams");
+		str = gettext("Allow sending datasets, but only in 'raw'"
+		    "\n\t\t\t\treplication mode");
+		break;
+	case ZFS_DELEG_NOTE_SEND_ENCRYPTED:
+		str = gettext("Allow sending only encrypted datasets, and"
+		    "\n\t\t\t\tonly in 'raw' replication mode");
 		break;
 	case ZFS_DELEG_NOTE_SHARE:
 		str = gettext("Allows sharing file systems over NFS or SMB"

include/sys/dsl_deleg.h

@@ -47,6 +47,7 @@ extern "C" {
 #define	ZFS_DELEG_PERM_SHARE		"share"
 #define	ZFS_DELEG_PERM_SEND		"send"
 #define	ZFS_DELEG_PERM_SEND_RAW		"send:raw"
+#define	ZFS_DELEG_PERM_SEND_ENCRYPTED	"send:encrypted"
 #define	ZFS_DELEG_PERM_RECEIVE		"receive"
 #define	ZFS_DELEG_PERM_RECEIVE_APPEND	"receive:append"
 #define	ZFS_DELEG_PERM_ALLOW		"allow"

include/zfs_deleg.h

@@ -56,6 +56,7 @@ typedef enum {
 	ZFS_DELEG_NOTE_RENAME,
 	ZFS_DELEG_NOTE_SEND,
 	ZFS_DELEG_NOTE_SEND_RAW,
+	ZFS_DELEG_NOTE_SEND_ENCRYPTED,
 	ZFS_DELEG_NOTE_RECEIVE,
 	ZFS_DELEG_NOTE_ALLOW,
 	ZFS_DELEG_NOTE_USERPROP,

man/man8/zfs-allow.8

@@ -29,8 +29,9 @@
 .\" Copyright 2019 Richard Laager. All rights reserved.
 .\" Copyright 2018 Nexenta Systems, Inc.
 .\" Copyright 2019 Joyent, Inc.
+.\" Copyright (c) 2026, TrueNAS.
 .\"
-.Dd September 8, 2025
+.Dd June 14, 2026
 .Dt ZFS-ALLOW 8
 .Os
 .
@@ -214,6 +215,7 @@ rename	subcommand	Must also have the \fBmount\fR and \fBcreate\fR ability in the
 rollback	subcommand	Must also have the \fBmount\fR ability
 send	subcommand	Allows sending a replication stream of a dataset.
 send:raw	subcommand	Only allows sending raw replication streams, preventing encrypted datasets being sent in decrypted form.
+send:encrypted	subcommand	Only allows sending raw replication streams of encrypted datasets, preventing encrypted datasets being sent in decrypted form and preventing decrypted datasets being sent at all.
 share	subcommand	Allows sharing file systems over NFS or SMB protocols
 snapshot	subcommand	Must also have the \fBmount\fR ability
 

module/zcommon/zfs_deleg.c

@@ -60,6 +60,7 @@ const zfs_deleg_perm_tab_t zfs_deleg_perm_tab[] = {
 	{ZFS_DELEG_PERM_SHARE},
 	{ZFS_DELEG_PERM_SEND},
 	{ZFS_DELEG_PERM_SEND_RAW},
+	{ZFS_DELEG_PERM_SEND_ENCRYPTED},
 	{ZFS_DELEG_PERM_USERPROP},
 	{ZFS_DELEG_PERM_USERQUOTA},
 	{ZFS_DELEG_PERM_GROUPQUOTA},

module/zfs/zfs_ioctl.c

@@ -825,6 +825,17 @@ zfs_secpolicy_send_impl(const char *name, dsl_dataset_t *ds, cred_t *cr,
 		err = dsl_deleg_access_impl(ds, ZFS_DELEG_PERM_SEND_RAW, cr);
 		if (err == 0)
 			return (0);
+
+		if (ds->ds_dir->dd_crypto_obj != 0) {
+			/*
+			 * Dataset is encrypted; 'send:encrypted' permission
+			 * will allow a raw send.
+			 */
+			err = dsl_deleg_access_impl(ds,
+			    ZFS_DELEG_PERM_SEND_ENCRYPTED, cr);
+			if (err == 0)
+				return (0);
+		}
 	}
 
 	return (err);