mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-12-25 01:34:11 +03:00
39cef12a95
Starting with QEMU 2.9, encryption convert processing requires
a multi-step process in order to generate an encrypted image from
some non encrypted raw image.
Processing requires to first create an encrypted image using the
sizing parameters from the input source and second to use the
--image-opts, -n, and --target-image-opts options along with inline
driver options to describe the input and output files, generating
two commands such as:
$ qemu-img create -f luks \
--object secret,id=demo.img_encrypt0,file=/path/to/secretFile \
-o key-secret=demo.img_encrypt0 \
demo.img 500K
Formatting 'demo.img', fmt=luks size=512000 key-secret=demo.img_encrypt0
$ qemu-img convert --image-opts -n --target-image-opts \
--object secret,id=demo.img_encrypt0,file=/path/to/secretFile \
driver=raw,file.filename=sparse.img \
driver=luks,file.filename=demo.img,key-secret=demo.img_encrypt0
$
This patch handles the convert processing by running the processing
in a do..while loop essentially reusing the existing create logic and
arguments to create the target vol from the inputvol and then converting
the inputvol using new arguments.
This then allows the following virsh command to work properly:
virsh vol-create-from default encrypt1-luks.xml data.img --inputpool default
where encrypt1-luks.xml would provided the path and secret for
the new image, while data.img would be the source image.
Signed-off-by: John Ferlan <jferlan@redhat.com>
ACKed-by: Michal Privoznik <mprivozn@redhat.com>
22 lines
586 B
XML
22 lines
586 B
XML
<volume>
|
|
<name>OtherDemo.img</name>
|
|
<key>/var/lib/libvirt/images/OtherDemo.img</key>
|
|
<source>
|
|
</source>
|
|
<capacity unit="G">5</capacity>
|
|
<allocation>294912</allocation>
|
|
<target>
|
|
<path>/var/lib/libvirt/images/OtherDemo.img</path>
|
|
<format type='raw'/>
|
|
<permissions>
|
|
<mode>0644</mode>
|
|
<owner>0</owner>
|
|
<group>0</group>
|
|
<label>unconfined_u:object_r:virt_image_t:s0</label>
|
|
</permissions>
|
|
<encryption format='luks'>
|
|
<secret type='passphrase' uuid='e78d4b51-a2af-485f-b0f5-afca709a80f4'/>
|
|
</encryption>
|
|
</target>
|
|
</volume>
|