Clarify that deduped data is encrypted

Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Reviewed-by: George Melikov <mail@gmelikov.ru>
Reviewed-by: Tom Caputi <tcaputi@datto.com>
Signed-off-by: Richard Laager <rlaager@wiktel.com>
Closes #8691

diff --git a/man/man8/zfs.8 b/man/man8/zfs.8
index 3b118ac3e9670c6b2328681eeacc2cd0e53b7ed0..7c8e5bc2ed54fc1b69a3e6f57d411909c877cec1 100644 (file)
--- a/man/man8/zfs.8
+++ b/man/man8/zfs.8
@@ -2388,7 +2388,8 @@ directory listings, FUID mappings, and
 .Sy groupused
 data.  ZFS will not encrypt metadata related to the pool structure, including
 dataset and snapshot names, dataset hierarchy, properties, file size, file
-holes, and deduplication tables.
+holes, and deduplication tables (though the deduplicated data itself is
+encrypted).
 .Pp
 Key rotation is managed by ZFS.  Changing the user's key (e.g. a passphrase)
 does not require re-encrypting the entire dataset.  Datasets can be scrubbed,