External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 05:35:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

storage: Add capability to use LUKS encryption for disk backend

Browse Source 
https://bugzilla.redhat.com/show_bug.cgi?id=1560946

Similar to the the Logical backend, use qemu-img on the created
disk partition device to set up for LUKS encryption. Secret mgmt
for the device can be complicated by a reboot possibly changing
the path to the device if the infrastructure changes.

Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Peter Krempa <pkrempa@redhat.com>
This commit is contained in:
John Ferlan 2018-05-21 06:40:58 -04:00
parent b8b42ca036
commit 57d6df39bd
1 changed files with 32 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
src/storage/storage_backend_disk.c
View File

@ -879,16 +879,17 @@ virStorageBackendDiskCreateVol(virStoragePoolObjPtr pool,
char *partFormat = NULL;
unsigned long long startOffset = 0, endOffset = 0;
virStoragePoolDefPtr def = virStoragePoolObjGetDef(pool);
virErrorPtr save_err;
virCommandPtr cmd = virCommandNewArgList(PARTED,
def->source.devices[0].path,
"mkpart",
"--script",
NULL);
if (vol->target.encryption != NULL) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
"%s", _("storage pool does not support encrypted "
"volumes"));
if (vol->target.encryption &&
vol->target.encryption->format != VIR_STORAGE_ENCRYPTION_FORMAT_LUKS) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("storage pool only supports LUKS encrypted volumes"));
goto cleanup;
}
@ -896,11 +897,14 @@ virStorageBackendDiskCreateVol(virStoragePoolObjPtr pool,
goto cleanup;
virCommandAddArg(cmd, partFormat);
if (virStorageBackendDiskPartBoundaries(pool, &startOffset,
&endOffset,
vol->target.capacity) != 0) {
/* If we're going to encrypt using LUKS, then we could need up to
* an extra 2MB for the LUKS header - so account for that now */
if (vol->target.encryption)
vol->target.capacity += 2 * 1024 * 1024;
if (virStorageBackendDiskPartBoundaries(pool, &startOffset, &endOffset,
vol->target.capacity) < 0)
goto cleanup;
}
virCommandAddArgFormat(cmd, "%lluB", startOffset);
virCommandAddArgFormat(cmd, "%lluB", endOffset);
@ -919,15 +923,15 @@ virStorageBackendDiskCreateVol(virStoragePoolObjPtr pool,
VIR_FREE(vol->target.path);
/* Fetch actual extent info, generate key */
if (virStorageBackendDiskReadPartitions(pool, vol) < 0) {
/* Best effort to remove the partition. Ignore any errors
* since we could be calling this with vol->target.path == NULL
*/
virErrorPtr save_err = virSaveLastError();
ignore_value(virStorageBackendDiskDeleteVol(pool, vol, 0));
virSetError(save_err);
virFreeError(save_err);
goto cleanup;
if (virStorageBackendDiskReadPartitions(pool, vol) < 0)
goto error;
if (vol->target.encryption) {
/* Adjust the sizes to account for the LUKS header */
vol->target.capacity -= 2 * 1024 * 1024;
vol->target.allocation -= 2 * 1024 * 1024;
if (virStorageBackendCreateVolUsingQemuImg(pool, vol, NULL, 0) < 0)
goto error;
}
res = 0;
@ -936,8 +940,19 @@ virStorageBackendDiskCreateVol(virStoragePoolObjPtr pool,
VIR_FREE(partFormat);
virCommandFree(cmd);
return res;
error:
/* Best effort to remove the partition. Ignore any errors
* since we could be calling this with vol->target.path == NULL
*/
save_err = virSaveLastError();
ignore_value(virStorageBackendDiskDeleteVol(pool, vol, 0));
virSetError(save_err);
virFreeError(save_err);
goto cleanup;
}
static int
virStorageBackendDiskBuildVolFrom(virStoragePoolObjPtr pool,
virStorageVolDefPtr vol,