mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-25 01:34:11 +03:00
qemu: Don't assume secret provided for LUKS encryption
https://bugzilla.redhat.com/show_bug.cgi?id=1405269 If a secret was not provided for what was determined to be a LUKS encrypted disk (during virStorageFileGetMetadata processing when called from qemuDomainDetermineDiskChain as a result of hotplug attach qemuDomainAttachDeviceDiskLive), then do not attempt to look it up (avoiding a libvirtd crash) and do not alter the format to "luks" when adding the disk; otherwise, the device_add would fail with a message such as: "unable to execute QEMU command 'device_add': Property 'scsi-hd.drive' can't find value 'drive-scsi0-0-0-0'" because of assumptions that when the format=luks that libvirt would have provided the secret to decrypt the volume. Access to unlock the volume will thus be left to the application.
This commit is contained in:
parent
0735ddf744
commit
7f7d990483
@ -1442,8 +1442,7 @@ qemuBuildDriveSourceStr(virDomainDiskDefPtr disk,
|
||||
if (disk->src->format > 0 &&
|
||||
disk->src->type != VIR_STORAGE_TYPE_DIR) {
|
||||
const char *qemuformat = virStorageFileFormatTypeToString(disk->src->format);
|
||||
if (disk->src->encryption &&
|
||||
disk->src->encryption->format == VIR_STORAGE_ENCRYPTION_FORMAT_LUKS)
|
||||
if (qemuDomainDiskHasEncryptionSecret(disk->src))
|
||||
qemuformat = "luks";
|
||||
virBufferAsprintf(buf, "format=%s,", qemuformat);
|
||||
}
|
||||
|
@ -1174,6 +1174,18 @@ qemuDomainSecretDiskCapable(virStorageSourcePtr src)
|
||||
}
|
||||
|
||||
|
||||
bool
|
||||
qemuDomainDiskHasEncryptionSecret(virStorageSourcePtr src)
|
||||
{
|
||||
if (!virStorageSourceIsEmpty(src) && src->encryption &&
|
||||
src->encryption->format == VIR_STORAGE_ENCRYPTION_FORMAT_LUKS &&
|
||||
src->encryption->nsecrets > 0)
|
||||
return true;
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
/* qemuDomainSecretDiskPrepare:
|
||||
* @conn: Pointer to connection
|
||||
* @priv: pointer to domain private object
|
||||
@ -1209,8 +1221,7 @@ qemuDomainSecretDiskPrepare(virConnectPtr conn,
|
||||
diskPriv->secinfo = secinfo;
|
||||
}
|
||||
|
||||
if (!virStorageSourceIsEmpty(src) && src->encryption &&
|
||||
src->encryption->format == VIR_STORAGE_ENCRYPTION_FORMAT_LUKS) {
|
||||
if (qemuDomainDiskHasEncryptionSecret(src)) {
|
||||
|
||||
if (VIR_ALLOC(secinfo) < 0)
|
||||
return -1;
|
||||
|
@ -734,6 +734,9 @@ void qemuDomainSecretDiskDestroy(virDomainDiskDefPtr disk)
|
||||
bool qemuDomainSecretDiskCapable(virStorageSourcePtr src)
|
||||
ATTRIBUTE_NONNULL(1);
|
||||
|
||||
bool qemuDomainDiskHasEncryptionSecret(virStorageSourcePtr src)
|
||||
ATTRIBUTE_NONNULL(1);
|
||||
|
||||
int qemuDomainSecretDiskPrepare(virConnectPtr conn,
|
||||
qemuDomainObjPrivatePtr priv,
|
||||
virDomainDiskDefPtr disk)
|
||||
|
@ -3583,8 +3583,7 @@ qemuDomainRemoveDiskDevice(virQEMUDriverPtr driver,
|
||||
/* Similarly, if this is possible a device using LUKS encryption, we
|
||||
* can remove the luks object password too
|
||||
*/
|
||||
if (!virStorageSourceIsEmpty(disk->src) && disk->src->encryption &&
|
||||
disk->src->encryption->format == VIR_STORAGE_ENCRYPTION_FORMAT_LUKS) {
|
||||
if (qemuDomainDiskHasEncryptionSecret(disk->src)) {
|
||||
|
||||
if (!(encAlias =
|
||||
qemuDomainGetSecretAESAlias(disk->info.alias, true))) {
|
||||
|
Loading…
Reference in New Issue
Block a user