[libvirt] passing secrets to block devices

We're working on libvirt support for block device authentication [1]. To authenticate, rbd needs a username and a secret. Normally, to avoid putting the secret on the command line, you can store the secret in a file and pass the file to qemu, but when this is automated, there's no good way to know when the file can be removed. There are a few ways to pass the secret to qemu that avoid this problem: 1) pass an fd to an unlinked file containing the secret This is the simplest method, but it sounds like qemu developers don't like fd passing from libvirt. [2] 2) start guests paused, without disks requiring authentication, then use the drive_add monitor command to attach them This would make disks with authentication somewhat of a special case in libvirt, but would be simple to implement, and require no qemu changes. 3) start guests paused, then send the secret via a new QMP/HMP command (block_set_conf <key> <value>?) This is a larger change, but it would be more generally useful for changing configuration at runtime. What do you think is the best approach? [1] http://permalink.gmane.org/gmane.comp.file-systems.ceph.devel/4129 [2] http://lists.gnu.org/archive/html/qemu-devel/2011-08/msg02494.html