From nobody Fri Nov 21 10:12:04 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1763041203; cv=none; d=zohomail.com; s=zohoarc; b=ItTTH9vMfAiWhhaxd0YEYx1w3tjq5o4Dx85EcEQOvsm2owTkWWyks0/LllDDKuesZKJmyvZDhnJR5RaNe8BzdRbZaIiVBY9VX9FJ3LCPZZNtbfe5CU3SXeRWBLXPMhfsOYEwrY73WZSLUT4ybvpaNxSRPm+rd7eyTc/CA4/9ERM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1763041203; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id; bh=Ntlrc08fNoEdlgcfvxdvcYzJvc0AJAWYhAq1LDiI+OA=; b=Zfrd/bSiDJygI3ltKj3tXhC2COgjJmiB9/yasnXYpOQd3Rc4tw3eU0S1dy8FQeBSn79XTPrUaWNyoQP+8D1Fz8umizDBcCdM3EXoPbTJHoegkAxCoFDppC12r68hAWr6uJj0fJK10XY2Ijv39IyZ8iapAJ9lTXk6/Xmw/WSFDtE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1763041203417675.902903499372; Thu, 13 Nov 2025 05:40:03 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 60FFB448B0; Thu, 13 Nov 2025 08:40:02 -0500 (EST) Received: from [172.19.199.29] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 5AAC144920; Thu, 13 Nov 2025 08:37:10 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id BC05E44185; Thu, 13 Nov 2025 08:32:46 -0500 (EST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id B6DEA441AE for ; Thu, 13 Nov 2025 08:32:45 -0500 (EST) Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-313-woZOZD0fMNuIdX3928MLtw-1; Thu, 13 Nov 2025 08:32:44 -0500 Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-7b5d4e1de6dso846127b3a.0 for ; Thu, 13 Nov 2025 05:32:43 -0800 (PST) Received: from armenon-kvm.armenon-thinkpadp16vgen1.bengluru.csb ([49.36.110.242]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-7b927151380sm2373676b3a.38.2025.11.13.05.32.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Nov 2025 05:32:40 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1763040765; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Ntlrc08fNoEdlgcfvxdvcYzJvc0AJAWYhAq1LDiI+OA=; b=cMwUixXjgoyp1DPbUN7e7CDo+UeWuH1l0xeIKF7u6CTC4n8AJs7l/L+qsfbG8tePmKu5fw rU+1um5R/bHrjS4ODRA2i1CLuOO78n7Oq1S288wEQderesTl9VS2TVh//r1VBK7vhwxLUY Etpibw9b+kvxruhlAhL7nFeMLCKl9YY= X-MC-Unique: woZOZD0fMNuIdX3928MLtw-1 X-Mimecast-MFC-AGG-ID: woZOZD0fMNuIdX3928MLtw_1763040763 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763040763; x=1763645563; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=Ntlrc08fNoEdlgcfvxdvcYzJvc0AJAWYhAq1LDiI+OA=; b=DcTeqluqMHwqVVX4M6PLQ6OCnPRHt46d0TBscWDbARBbvDjU2ivtL2AEpq0Fb1GT2X 9wl2wC3vC50kLOSGcKnahxmeCfgY7+lJ02gQIz0L0tcwp7ai1hsm9klsXperHq7vyoPv uB0KHhORZRZJrJW8RKzZ79TlDirz4i2FlensI+TBZqW5UCsYJScbCDX5C/WKG/Tu7NUi or9PxDVLZbH9sjlATYnfpoVijmUMIvbfQtBGsQJwCAsXwegwmhzTMDZrP09UeAfmmpdq OUm17Vd7PuV69d+PO6gOh2aykL6glkX7byREIo2YrxmLKjYhj1IbT9dKdij5qVfVJT0+ aUVQ== X-Gm-Message-State: AOJu0YzwW+sGJmwUr+O3Jlc88U5y4jc+wjk0AeP3BYIGcDwPlHYihlK0 2mskbGdwlec9NAi98FeslF0DQ/UDUlyfSzTNsFvfX7ZAmDBK0iixTmiTA5KRXOYRVz974l27/gz 2wwGvHyW60O32iDr8ytbfHDGSmB/DZjEfUI+EaDRkqUskE0HPGKz44HNpw9tYF/GQiLIasHXKUB r2oH/6bXB6iNwBhaG1QZlbCvRz4ifPSevQaeaP0xiqNA== X-Gm-Gg: ASbGncvw1TFBPrLflZPgiv9bcRmhLndYmA0IxF6/yVyMOi2Oi+/cz/4ixcIbrKA8T7p jkfleyI1VnODnwct4e2lSRzgW3FVr3I4v41o4Pc7YDkIEX9UqQOroVlCF3b73ejJjZPYZ3Lbq7r X6SNEbQG4KuMC9YlqCMsGG75VuRTWI8QZIhrF5tiaITGon9c3dka2KeuSDKzWfPnbQq8raBbTYj cmiRi6/hF/FBshM12b9SR/zDmyjdhwSpx77CtzdKuvAq8ejqbRsP6B7TlLqCUmkgEp4vHZ1ZTcM Ce0AZ93d9J4BkDppZ0xuJeA3jr7LlQGrxspLZYpFquIxRv5O3PKxzP1w0e6OmtBO4kMqcg1TpE0 b58IYF3OCKlP3VNx6Ixzet3R6RT0uzsZx/oJnsBsQ4TsRQ88= X-Received: by 2002:a05:6a20:9389:b0:33f:4e3d:aff3 with SMTP id adf61e73a8af0-3590988b2e6mr9548163637.24.1763040762656; Thu, 13 Nov 2025 05:32:42 -0800 (PST) X-Google-Smtp-Source: AGHT+IFbgFP/ByT0n820FhiNUStEeu5PZbIOfyhxcXCJbqrKeZvp5jGEV+vwRn8Ov+LNSBoWTkm2fw== X-Received: by 2002:a05:6a20:9389:b0:33f:4e3d:aff3 with SMTP id adf61e73a8af0-3590988b2e6mr9548113637.24.1763040762061; Thu, 13 Nov 2025 05:32:42 -0800 (PST) To: devel@lists.libvirt.org Subject: [RFC 2/4] secret: Set up default encrypted master key for the virtsecretd service Date: Thu, 13 Nov 2025 19:02:21 +0530 Message-ID: <20251113133223.32729-3-armenon@redhat.com> X-Mailer: git-send-email 2.51.1 In-Reply-To: <20251113133223.32729-1-armenon@redhat.com> References: <20251113133223.32729-1-armenon@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: rqW9_vsmGYsWnFd4IKaSNMEkmmtYLawNu-Wcj23P-ao_1763040763 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 4FDHTS2UPS22VMSLRCTNQ6WZ75VB2LTZ X-Message-ID-Hash: 4FDHTS2UPS22VMSLRCTNQ6WZ75VB2LTZ X-MailFrom: armenon@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Arun Menon , =?UTF-8?q?Michal=20Pr=C3=ADvozn=C3=ADk?= X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Arun Menon via Devel Reply-To: Arun Menon X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1763041213902158501 Content-Type: text/plain; charset="utf-8"; x-default="true" This commit sets the foundation for encrypting the libvirt secrets by provi= ding a secure way to pass a master encryption key to the virtsecretd service. Add a default, pre-generated, master encryption key to the credentials, that can be consumed by the virtsecretd service. By using the "SetCredentialEncrypted=3D" directive, we make sure that passi= ng data to the service is secure. The virtsecretd service can then read the key from CREDENTIALS_DIRECTORY. [= 1] This setup therefore provides a default key out-of-the-box for initial use. Users can customize this setting, by replacing the default encrypted string with their own. A subsequent commit will introduce the logic for virtsecretd to access and use this key via the $CREDENTIALS_DIRECTORY environment varia= ble. [2] In order to add the default encryption key, a random 32 byte key was genera= ted and encrypted: dd if=3D/dev/urandom of=3D/tmp/master.key bs=3D1 count=3D32 systemd-creds encrypt --name=3Dmaster-encryption-key -p /tmp/master.key - This generates a SetCredentialEncrypted=3D line suitable for inclusion in t= he unit file. [1] https://www.freedesktop.org/software/systemd/man/latest/systemd-creds.h= tml [2] https://systemd.io/CREDENTIALS/ Signed-off-by: Arun Menon --- src/secret/virtsecretd.service.extra.in | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/secret/virtsecretd.service.extra.in b/src/secret/virtsecre= td.service.extra.in index 1fc8c672f7..0f65bc3bb1 100644 --- a/src/secret/virtsecretd.service.extra.in +++ b/src/secret/virtsecretd.service.extra.in @@ -1,2 +1,10 @@ # The contents of this unit will be merged into a base template. # Additional units might be merged as well. See meson.build for details. +# +[Service] +Environment=3DMASTER_ENCRYPTION_KEY=3D%d/master-encryption-key +SetCredentialEncrypted=3Dmaster-encryption-key: \ + Whxqht+dQJax1aZeCGLxmiAAAAABAAAADAAAABAAAAD9m5CsEfoZf8Lj/dQAAAAAFS= vJ7 \ + eSEmqQthu+A4Eqn4vEKp6jx7ScbcM98bcW5Do0K9V0eTPWD+eNJJrB+xS/MAklo3rk= f0S \ + 7n7rXk8SQZ0FQ5Uv8ZoOuidWPHHiLZGS9bxAJwTZvN/VX+pe+biC16 +LoadCredentialEncrypted=3Dmaster-encryption-key --=20 2.51.1