11:23 a.m.
Hey, guys
I've been working on whether libvirt supports encrypted snapshots,Here are my versions
of libvirt and qemu
[root@xx ~]# libvirtd -V
libvirtd (libvirt) 4.5.0
[root@xx ~]# qemu-img -V
qemu-img version 2.12.0 (qemu-kvm-ev-2.12.0-33.1.el7_7.4)
Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers
1. assign $MYSECRET to libvirt secret using the secret-define and secret-set-value
commands,and $MYSECRET is in base64 format
MYSECRET=`printf %s "123456" | base64`
2. created a disk encrypted in luks format
qemu-img create --object secret,id=sec0,data=$MYSECRET,format=base64 -f qcow2 -o
encrypt.format=luks,encrypt.key-secret=sec0 enc.qcow220G
3. The encrypted disk is defined in the XML configuration file, as shown below.Then I
successfully started the virtual machine.
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='/root/enc.qcow2'/>
<backingStore/>
<target dev='hda' bus='ide'/>
<encryption format='luks'>
<secret type='passphrase'
uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/>
</encryption>
<alias name='ide0-0-0'/>
<address type='drive' controller='0' bus='0'
target='0' unit='0'/>
</disk>
4. According to the qemu documentation, an encrypted snap.qcow2 disk was created with
enc.qcow2 as backing
qemu-img create -f qcow2 -F qcow2 --object secret,id=sec0,data=$MYSECRET,format=base64
--object secret,id=sec1,data=$MYSECRET,format=base64 -o
encrypt.format=luks,encrypt.key-secret=sec1 -b 'json:{"encrypt.key-secret":
"sec0", "driver": "qcow2", "file":
{"driver": "file", "filename":
"/root/enc/enc.qcow2"}}' snap.qcow2
I used the same $MYSECRET as the password data for the disk. Here is the disk information
for snap.qcow2
image: snap.qcow2
file format: qcow2
virtual size: 20G (21474836480 bytes)
disk size: 480K
encrypted: yes
cluster_size: 65536
backing file: json:{"encrypt.key-secret": "sec0", "driver":
"qcow2", "file": {"driver": "file",
"filename": "/root//enc.qcow2"}}
backing file format: qcow2
Format specific information:
compat: 1.1
lazy refcounts: false
refcount bits: 16
encrypt:
ivgen alg: plain64
hash alg: sha256
cipher alg: aes-256
uuid: ab0e3f87-35e7-40cb-9888-9fe9bb54e981
format: luks
cipher mode: xts
slots:
[0]:
active: true
iters: 115582
key offset: 4096
stripes: 4000
[1]:
active: false
key offset: 262144
[2]:
active: false
key offset: 520192
[3]:
active: false
key offset: 778240
[4]:
active: false
key offset: 1036288
[5]:
active: false
key offset: 1294336
[6]:
active: false
key offset: 1552384
[7]:
active: false
key offset: 1810432
payload offset: 2068480
master key iters: 30085
corrupt: false
5. Then I changed the configuration of the XML, as shown below.And re-define and start the
virtual machine
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='/root/snap.qcow2'/>
<backingStore type='file'>
<format type='qcow2'/>
<source file='/root/enc.qcow2'/>
<backingStore/>
</backingStore>
<target dev='hda' bus='ide'/>
<encryption format='luks'>
<secret type='passphrase'
uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/>
</encryption>
<address type='drive' controller='0' bus='0'
target='0' unit='0'/>
</disk>
Then the startup failed and an error was thrown. As shown below.
qemu-kvm: -drive
file=/root/enc/vm/enc-snap.qcow2,encrypt.format=luks,encrypt.key-secret=ide0-0-0-luks-secret0,format=qcow2,if=none,id=drive-ide0-0-0:
Could not open backing file: No secret with id 'sec0'
The sec0 secret id could not be found in the backing file, this is my problem.
Is there a problem with the way I implemented it, or does libvirt currently not support
this?
Any tips or help will be appreciated, Looking forward to your reply. Thank you
| |
18781374080
|
|
18781374080(a)163.com
|
签名由网易邮箱大师定制
1:24 a.m.
On Wed, Apr 15, 2020 at 10:53:05 +0800, 18781374080 wrote:
This is too-old encrypted backing files work starting from libvirt-5.10
(but I strongly suggest using at least 6.1)
And qemu-4.2
This won't work with libvirt. You can't pass "encrypt.key-secret":
"sec0" via the backing file string as there's no way to create the
corresponding secret object when starting the VM. You can fully omit it
here and use just '-b /root/enc/enc.qcow2'
[snip]
5. Then I changed the configuration of the XML, as shown below.And re-define and start
the virtual machine
With new libvirt mentioned above you'll have to add the encryption also
to the backing file. That will properly configure both layers to use the
correct encryption key.
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='/root/snap.qcow2'/>
<backingStore type='file'>
<format type='qcow2'/>
<source file='/root/enc.qcow2'>
<encryption format='luks'>
<secret type='passphrase'
uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/>
</encryption>
</source>
<backingStore/>
</backingStore>
<target dev='hda' bus='ide'/>
<encryption format='luks'>
<secret type='passphrase'
uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/>
</encryption>
<address type='drive' controller='0' bus='0'
target='0' unit='0'/>
</disk>
Note that also the top level source can have <encryption> as child of
<source>
As pointed out above, there's no way to instantiate the secret object
via the backing store string as that is done by libvirt explicitly via
-object on the command line.
11:23 a.m.
Thank you very much for your guidance!
| |
18781374080
|
|
18781374080(a)163.com
|
签名由网易邮箱大师定制
On 4/15/2020 14:24，Peter Krempa<pkrempa(a)redhat.com> wrote：
On Wed, Apr 15, 2020 at 10:53:05 +0800, 18781374080 wrote:
Hey, guys
I've been working on whether libvirt supports encrypted snapshots,Here are my versions
of libvirt and qemu
[root@xx ~]# libvirtd -V
libvirtd (libvirt) 4.5.0
This is too-old encrypted backing files work starting from libvirt-5.10
(but I strongly suggest using at least 6.1)
[root@xx ~]# qemu-img -V
qemu-img version 2.12.0 (qemu-kvm-ev-2.12.0-33.1.el7_7.4)
And qemu-4.2
Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers
1. assign $MYSECRET to libvirt secret using the secret-define and secret-set-value
commands,and $MYSECRET is in base64 format
MYSECRET=`printf %s "123456" | base64`
2. created a disk encrypted in luks format
qemu-img create --object secret,id=sec0,data=$MYSECRET,format=base64 -f qcow2 -o
encrypt.format=luks,encrypt.key-secret=sec0 enc.qcow220G
3. The encrypted disk is defined in the XML configuration file, as shown below.Then I
successfully started the virtual machine.
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='/root/enc.qcow2'/>
<backingStore/>
<target dev='hda' bus='ide'/>
<encryption format='luks'>
<secret type='passphrase'
uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/>
</encryption>
<alias name='ide0-0-0'/>
<address type='drive' controller='0' bus='0' target='0'
unit='0'/>
</disk>
4. According to the qemu documentation, an encrypted snap.qcow2 disk was created with
enc.qcow2 as backing
qemu-img create -f qcow2 -F qcow2 --object secret,id=sec0,data=$MYSECRET,format=base64
--object secret,id=sec1,data=$MYSECRET,format=base64 -o
encrypt.format=luks,encrypt.key-secret=sec1 -b 'json:{"encrypt.key-secret":
"sec0", "driver": "qcow2", "file":
{"driver": "file", "filename":
"/root/enc/enc.qcow2"}}' snap.qcow2
This won't work with libvirt. You can't pass "encrypt.key-secret":
"sec0" via the backing file string as there's no way to create the
corresponding secret object when starting the VM. You can fully omit it
here and use just '-b /root/enc/enc.qcow2'
I used the same $MYSECRET as the password data for the disk. Here is the disk information
for snap.qcow2
image: snap.qcow2
file format: qcow2
virtual size: 20G (21474836480 bytes)
disk size: 480K
encrypted: yes
cluster_size: 65536
backing file: json:{"encrypt.key-secret": "sec0", "driver":
"qcow2", "file": {"driver": "file",
"filename": "/root//enc.qcow2"}}
backing file format: qcow2
Format specific information:
compat: 1.1
lazy refcounts: false
refcount bits: 16
encrypt:
ivgen alg: plain64
hash alg: sha256
cipher alg: aes-256
uuid: ab0e3f87-35e7-40cb-9888-9fe9bb54e981
format: luks
cipher mode: xts
[snip]
5. Then I changed the configuration of the XML, as shown below.And re-define and start the
virtual machine
With new libvirt mentioned above you'll have to add the encryption also
to the backing file. That will properly configure both layers to use the
correct encryption key.
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='/root/snap.qcow2'/>
<backingStore type='file'>
<format type='qcow2'/>
<source file='/root/enc.qcow2'>
<encryption format='luks'>
<secret type='passphrase'
uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/>
</encryption>
</source>
<backingStore/>
</backingStore>
<target dev='hda' bus='ide'/>
<encryption format='luks'>
<secret type='passphrase'
uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/>
</encryption>
<address type='drive' controller='0' bus='0' target='0'
unit='0'/>
</disk>
Note that also the top level source can have <encryption> as child of
<source>
Then the startup failed and an error was thrown. As shown below.
qemu-kvm: -drive
file=/root/enc/vm/enc-snap.qcow2,encrypt.format=luks,encrypt.key-secret=ide0-0-0-luks-secret0,format=qcow2,if=none,id=drive-ide0-0-0:
Could not open backing file: No secret with id 'sec0'
As pointed out above, there's no way to instantiate the secret object
via the backing store string as that is done by libvirt explicitly via
-object on the command line.
The sec0 secret id could not be found in the backing file, this is my problem.
Is there a problem with the way I implemented it, or does libvirt currently not support
this?
Any tips or help will be appreciated, Looking forward to your reply. Thank you
| |
18781374080
|
|
18781374080(a)163.com
|
签名由网易邮箱大师定制
522
days inactive
522
days old
2 comments
2 participants
participants (2)
-
18781374080 -
Peter Krempa