Can't start vm with enc backing files, No secret with id 'sec0' ?
Hey, guys I've been working on whether libvirt supports encrypted snapshots,Here are my versions of libvirt and qemu [root@xx ~]# libvirtd -V libvirtd (libvirt) 4.5.0 [root@xx ~]# qemu-img -V qemu-img version 2.12.0 (qemu-kvm-ev-2.12.0-33.1.el7_7.4) Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers 1. assign $MYSECRET to libvirt secret using the secret-define and secret-set-value commands,and $MYSECRET is in base64 format MYSECRET=`printf %s "123456" | base64` 2. created a disk encrypted in luks format qemu-img create --object secret,id=sec0,data=$MYSECRET,format=base64 -f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 enc.qcow220G 3. The encrypted disk is defined in the XML configuration file, as shown below.Then I successfully started the virtual machine. <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/root/enc.qcow2'/> <backingStore/> <target dev='hda' bus='ide'/> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> <alias name='ide0-0-0'/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> 4. According to the qemu documentation, an encrypted snap.qcow2 disk was created with enc.qcow2 as backing qemu-img create -f qcow2 -F qcow2 --object secret,id=sec0,data=$MYSECRET,format=base64 --object secret,id=sec1,data=$MYSECRET,format=base64 -o encrypt.format=luks,encrypt.key-secret=sec1 -b 'json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root/enc/enc.qcow2"}}' snap.qcow2 I used the same $MYSECRET as the password data for the disk. Here is the disk information for snap.qcow2 image: snap.qcow2 file format: qcow2 virtual size: 20G (21474836480 bytes) disk size: 480K encrypted: yes cluster_size: 65536 backing file: json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root//enc.qcow2"}} backing file format: qcow2 Format specific information: compat: 1.1 lazy refcounts: false refcount bits: 16 encrypt: ivgen alg: plain64 hash alg: sha256 cipher alg: aes-256 uuid: ab0e3f87-35e7-40cb-9888-9fe9bb54e981 format: luks cipher mode: xts slots: [0]: active: true iters: 115582 key offset: 4096 stripes: 4000 [1]: active: false key offset: 262144 [2]: active: false key offset: 520192 [3]: active: false key offset: 778240 [4]: active: false key offset: 1036288 [5]: active: false key offset: 1294336 [6]: active: false key offset: 1552384 [7]: active: false key offset: 1810432 payload offset: 2068480 master key iters: 30085 corrupt: false 5. Then I changed the configuration of the XML, as shown below.And re-define and start the virtual machine <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/root/snap.qcow2'/> <backingStore type='file'> <format type='qcow2'/> <source file='/root/enc.qcow2'/> <backingStore/> </backingStore> <target dev='hda' bus='ide'/> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> Then the startup failed and an error was thrown. As shown below. qemu-kvm: -drive file=/root/enc/vm/enc-snap.qcow2,encrypt.format=luks,encrypt.key-secret=ide0-0-0-luks-secret0,format=qcow2,if=none,id=drive-ide0-0-0: Could not open backing file: No secret with id 'sec0' The sec0 secret id could not be found in the backing file, this is my problem. Is there a problem with the way I implemented it, or does libvirt currently not support this? Any tips or help will be appreciated, Looking forward to your reply. Thank you | | 18781374080 | | 18781374080@163.com | 签名由网易邮箱大师定制
On Wed, Apr 15, 2020 at 10:53:05 +0800, 18781374080 wrote:
Hey, guys
I've been working on whether libvirt supports encrypted snapshots,Here are my versions of libvirt and qemu
[root@xx ~]# libvirtd -V
libvirtd (libvirt) 4.5.0
This is too-old encrypted backing files work starting from libvirt-5.10 (but I strongly suggest using at least 6.1)
[root@xx ~]# qemu-img -V
qemu-img version 2.12.0 (qemu-kvm-ev-2.12.0-33.1.el7_7.4)
And qemu-4.2
Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers
1. assign $MYSECRET to libvirt secret using the secret-define and secret-set-value commands,and $MYSECRET is in base64 format
MYSECRET=`printf %s "123456" | base64`
2. created a disk encrypted in luks format
qemu-img create --object secret,id=sec0,data=$MYSECRET,format=base64 -f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 enc.qcow220G
3. The encrypted disk is defined in the XML configuration file, as shown below.Then I successfully started the virtual machine.
<disk type='file' device='disk'>
<driver name='qemu' type='qcow2'/>
<source file='/root/enc.qcow2'/>
<backingStore/>
<target dev='hda' bus='ide'/>
<encryption format='luks'>
<secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/>
</encryption>
<alias name='ide0-0-0'/>
<address type='drive' controller='0' bus='0' target='0' unit='0'/>
</disk>
4. According to the qemu documentation, an encrypted snap.qcow2 disk was created with enc.qcow2 as backing
qemu-img create -f qcow2 -F qcow2 --object secret,id=sec0,data=$MYSECRET,format=base64 --object secret,id=sec1,data=$MYSECRET,format=base64 -o encrypt.format=luks,encrypt.key-secret=sec1 -b 'json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root/enc/enc.qcow2"}}' snap.qcow2
This won't work with libvirt. You can't pass "encrypt.key-secret": "sec0" via the backing file string as there's no way to create the corresponding secret object when starting the VM. You can fully omit it here and use just '-b /root/enc/enc.qcow2'
I used the same $MYSECRET as the password data for the disk. Here is the disk information for snap.qcow2
image: snap.qcow2
file format: qcow2
virtual size: 20G (21474836480 bytes)
disk size: 480K
encrypted: yes
cluster_size: 65536
backing file: json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root//enc.qcow2"}}
backing file format: qcow2
Format specific information:
compat: 1.1
lazy refcounts: false
refcount bits: 16
encrypt:
ivgen alg: plain64
hash alg: sha256
cipher alg: aes-256
uuid: ab0e3f87-35e7-40cb-9888-9fe9bb54e981
format: luks
cipher mode: xts
[snip]
5. Then I changed the configuration of the XML, as shown below.And re-define and start the virtual machine
With new libvirt mentioned above you'll have to add the encryption also to the backing file. That will properly configure both layers to use the correct encryption key. <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/root/snap.qcow2'/> <backingStore type='file'> <format type='qcow2'/> <source file='/root/enc.qcow2'> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> </source> <backingStore/> </backingStore> <target dev='hda' bus='ide'/> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> Note that also the top level source can have <encryption> as child of <source>
Then the startup failed and an error was thrown. As shown below.
qemu-kvm: -drive file=/root/enc/vm/enc-snap.qcow2,encrypt.format=luks,encrypt.key-secret=ide0-0-0-luks-secret0,format=qcow2,if=none,id=drive-ide0-0-0: Could not open backing file: No secret with id 'sec0'
As pointed out above, there's no way to instantiate the secret object via the backing store string as that is done by libvirt explicitly via -object on the command line.
The sec0 secret id could not be found in the backing file, this is my problem.
Is there a problem with the way I implemented it, or does libvirt currently not support this?
Any tips or help will be appreciated, Looking forward to your reply. Thank you
| | 18781374080 | | 18781374080@163.com | 签名由网易邮箱大师定制
Thank you very much for your guidance! | | 18781374080 | | 18781374080@163.com | 签名由网易邮箱大师定制 On 4/15/2020 14:24，Peter Krempa<pkrempa@redhat.com> wrote： On Wed, Apr 15, 2020 at 10:53:05 +0800, 18781374080 wrote: Hey, guys I've been working on whether libvirt supports encrypted snapshots,Here are my versions of libvirt and qemu [root@xx ~]# libvirtd -V libvirtd (libvirt) 4.5.0 This is too-old encrypted backing files work starting from libvirt-5.10 (but I strongly suggest using at least 6.1) [root@xx ~]# qemu-img -V qemu-img version 2.12.0 (qemu-kvm-ev-2.12.0-33.1.el7_7.4) And qemu-4.2 Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers 1. assign $MYSECRET to libvirt secret using the secret-define and secret-set-value commands,and $MYSECRET is in base64 format MYSECRET=`printf %s "123456" | base64` 2. created a disk encrypted in luks format qemu-img create --object secret,id=sec0,data=$MYSECRET,format=base64 -f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 enc.qcow220G 3. The encrypted disk is defined in the XML configuration file, as shown below.Then I successfully started the virtual machine. <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/root/enc.qcow2'/> <backingStore/> <target dev='hda' bus='ide'/> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> <alias name='ide0-0-0'/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> 4. According to the qemu documentation, an encrypted snap.qcow2 disk was created with enc.qcow2 as backing qemu-img create -f qcow2 -F qcow2 --object secret,id=sec0,data=$MYSECRET,format=base64 --object secret,id=sec1,data=$MYSECRET,format=base64 -o encrypt.format=luks,encrypt.key-secret=sec1 -b 'json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root/enc/enc.qcow2"}}' snap.qcow2 This won't work with libvirt. You can't pass "encrypt.key-secret": "sec0" via the backing file string as there's no way to create the corresponding secret object when starting the VM. You can fully omit it here and use just '-b /root/enc/enc.qcow2' I used the same $MYSECRET as the password data for the disk. Here is the disk information for snap.qcow2 image: snap.qcow2 file format: qcow2 virtual size: 20G (21474836480 bytes) disk size: 480K encrypted: yes cluster_size: 65536 backing file: json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root//enc.qcow2"}} backing file format: qcow2 Format specific information: compat: 1.1 lazy refcounts: false refcount bits: 16 encrypt: ivgen alg: plain64 hash alg: sha256 cipher alg: aes-256 uuid: ab0e3f87-35e7-40cb-9888-9fe9bb54e981 format: luks cipher mode: xts [snip] 5. Then I changed the configuration of the XML, as shown below.And re-define and start the virtual machine With new libvirt mentioned above you'll have to add the encryption also to the backing file. That will properly configure both layers to use the correct encryption key. <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/root/snap.qcow2'/> <backingStore type='file'> <format type='qcow2'/> <source file='/root/enc.qcow2'> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> </source> <backingStore/> </backingStore> <target dev='hda' bus='ide'/> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> Note that also the top level source can have <encryption> as child of <source> Then the startup failed and an error was thrown. As shown below. qemu-kvm: -drive file=/root/enc/vm/enc-snap.qcow2,encrypt.format=luks,encrypt.key-secret=ide0-0-0-luks-secret0,format=qcow2,if=none,id=drive-ide0-0-0: Could not open backing file: No secret with id 'sec0' As pointed out above, there's no way to instantiate the secret object via the backing store string as that is done by libvirt explicitly via -object on the command line. The sec0 secret id could not be found in the backing file, this is my problem. Is there a problem with the way I implemented it, or does libvirt currently not support this? Any tips or help will be appreciated, Looking forward to your reply. Thank you | | 18781374080 | | 18781374080@163.com | 签名由网易邮箱大师定制
participants (2)
-
18781374080 -
Peter Krempa