From nobody Fri Nov 21 10:10:51 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1763658080; cv=none; d=zohomail.com; s=zohoarc; b=UAm0PONikmKav7WmnlE28QaWxubvSwzJlJ6DofMXPQd8m/syljboI2M44wA40E4CBT21ElEzUS5IY8RbV1LKrsmeWMDjFccRk/34dLAuTV98bkKb0RI/rC1Gs9yboCwwHonPwnNxUJsJPDWiNahlJSeX8VDUhtJkBeHCBUEqYlE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1763658080; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id; bh=2dDQewInVeWRq4aMUN6K3LU5il+wfkjI3csuS3DNvMY=; b=VxMqYG6FkdZ6SWY3IzpWr5APTR6fTdLGJo1bF4D9nUEHBAkBu3BGccNXjm3I7SFa5kAH9TTIKis3nvzLNY4+IvCbHG5AaTrYpdHcr/F+hsMxUYjh8MtBBthkvdP9IvetTDS7lIvM/Po1n7z2lVrItrVxA+Azra2hw9GbpzCYQ+Y= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1763658080438231.94704533640618; Thu, 20 Nov 2025 09:01:20 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id E513F44059; Thu, 20 Nov 2025 12:01:17 -0500 (EST) Received: from [172.19.199.53] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 0DEF9442F9; Thu, 20 Nov 2025 11:57:25 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 334C241ADD; Thu, 20 Nov 2025 11:54:01 -0500 (EST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 024A43F87C for ; Thu, 20 Nov 2025 11:53:58 -0500 (EST) Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-665-Xy7EUwndNk-4QjwF4yG2vQ-1; Thu, 20 Nov 2025 11:53:57 -0500 Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-343823be748so1146217a91.0 for ; Thu, 20 Nov 2025 08:53:56 -0800 (PST) Received: from armenon-kvm.armenon-thinkpadp16vgen1.bengluru.csb ([49.36.104.36]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-34727bcaf5asm2887551a91.4.2025.11.20.08.53.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Nov 2025 08:53:54 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1763657638; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2dDQewInVeWRq4aMUN6K3LU5il+wfkjI3csuS3DNvMY=; b=dbBecIfch5ZqQOiJmjmgSgNRpfDgipONPATc+obSBvdpNybdUMMfB9NoE9FVziVedyCfgp mpWIsvMvPXAFvS40qVpczyU2XTva+6KLhg02yukz6hrtg7YZgfsNecxBte47oSNq3UzEBG zIWgPYku0UwRrGgytLt9HGQi3SK9VQk= X-MC-Unique: Xy7EUwndNk-4QjwF4yG2vQ-1 X-Mimecast-MFC-AGG-ID: Xy7EUwndNk-4QjwF4yG2vQ_1763657636 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763657636; x=1764262436; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=2dDQewInVeWRq4aMUN6K3LU5il+wfkjI3csuS3DNvMY=; b=f61dy8yEybBmEOD6G2KRrMPW5I0RQoxGs4zFYw8ifk9Zcyk8XWMAtdF19iacWsB4il 94CYc/Rua7dlAI61yh+KmpdJgAMBsLrPFwnh/wh+LVW7h1hHgU0w1usHMQ/DpVrTMaz1 8K0N7Rdv8mjGUeTuEqyWPUtvAg0F1xTrV1sx3zLcg6Y3ABbbLqXeKI1gmpjOmhkYljKj RKI25atz8hiI3w+lmioSqmzPyl9chScjbl5g6pm/T/MIW6RZN8VuN6mk2M9wMzKgOYO0 AnaAJUMiruN8vao2/LrdHiKSVGaiXKe/v4QQCm1DryhCmuxw0oEwNx0O+9miTyMOk6es dkLw== X-Gm-Message-State: AOJu0YzbaX71oSLYlnPooZX9GYyqQdI/H0t3aC5dnY1LfVZAysHRWVLz LeM1CqF5xo0R4/yzM9Ic1YNQHTofA5hklt9USdfpDuCzkbHsKQQgVlwOlKx59L5Z6H8u1QOsFnV EniQgZJ5e3JfE8PoHQlZklSdZZZAHsPLH9Z1pc0qzvrPoLAnEbdqeKpyeooxyf4rmiSNXkyVYdN 1HAK34EysGYECJTkz0Xxrkr3P9WWmztp0NgLk0u+vuIQ== X-Gm-Gg: ASbGncv479G8y7Tx8b50ZkLmArRAFm7heK8H2LICn4zN+PzxNfdju646FPcZ6HII8Ke pd1/EtrTwC9qIPGrk2waeRMBObht7FT6YsFxs2U1ixuFkMPWQHZl0wnhEFozOR2Kh8dT7pSLCIS /edUrNw3Vw2iV4srcd5RMQ/m/bTYQKyxxyQGXPIWSbLCuDd0ezTFKH+r1wb8NkrLB8DCayamN/4 QZ45F0nojbCQaZPOo2vcVKk2LaWzuvaZfRRU7peAGDUvubclvXx4RWoH/w46r7cgVkEY96Y/Xap g72pzfcBTvE41pCSfixoQKlrCYgkqH+6/zkbsKftc35VAxsovCywLtXFTlsE/W16vQl9sAq/Nz9 A8ppyR1wZQtf9e3TxwQZ3cyz1Wdvkz+j7eVZi87ZpWKOE07EFDgo6Sece X-Received: by 2002:a17:90b:3ec8:b0:33f:ebdd:9961 with SMTP id 98e67ed59e1d1-34727d702b9mr3831373a91.28.1763657635575; Thu, 20 Nov 2025 08:53:55 -0800 (PST) X-Google-Smtp-Source: AGHT+IHIeBNBb8nhftEHIpS+Fkf0hVDDI7/HLgrk075FzI+WQOcuWsytnavyRRdKDxS8yIyrAl2zmw== X-Received: by 2002:a17:90b:3ec8:b0:33f:ebdd:9961 with SMTP id 98e67ed59e1d1-34727d702b9mr3831351a91.28.1763657634971; Thu, 20 Nov 2025 08:53:54 -0800 (PST) To: devel@lists.libvirt.org Subject: [RFC v2 2/5] secret: Set up default encrypted secret key for the virtsecretd service Date: Thu, 20 Nov 2025 22:23:43 +0530 Message-ID: <20251120165346.161124-3-armenon@redhat.com> X-Mailer: git-send-email 2.51.1 In-Reply-To: <20251120165346.161124-1-armenon@redhat.com> References: <20251120165346.161124-1-armenon@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: UYo8yQMpY5BN8WNAdAntHKSrFadkuofqHDR3dQLqRSY_1763657636 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: FWUKBPXVSC6CMNW4QMX5ZG7P7BZWCVWG X-Message-ID-Hash: FWUKBPXVSC6CMNW4QMX5ZG7P7BZWCVWG X-MailFrom: armenon@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Arun Menon X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Arun Menon via Devel Reply-To: Arun Menon X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1763658095082018900 Content-Type: text/plain; charset="utf-8"; x-default="true" This commit sets the foundation for encrypting the libvirt secrets by provi= ding a secure way to pass a secret encryption key to the virtsecretd service. A random secret key is generated using the new virt-secret-init-encryption service. This key can be consumed by the virtsecretd service. By using the "Before=3D" directive in the new secret-init-encryption service and using "Requires=3D" directive in the virtsecretd service, we make sure that the daemon is run only after we have an encrypted secret key file generated and placed in /var/lib/libvirt/secrets. The virtsecretd service can then read the key from CREDENTIALS_DIRECTORY. [= 1] This setup therefore provides a default key out-of-the-box for initial use. A subsequent commit will introduce the logic for virtsecretd to access and use this key via the $CREDENTIALS_DIRECTORY environment varia= ble. [2] [1] https://www.freedesktop.org/software/systemd/man/latest/systemd-creds.h= tml [2] https://systemd.io/CREDENTIALS/ Signed-off-by: Arun Menon --- libvirt.spec.in | 7 +++++++ src/secret/meson.build | 8 ++++++++ src/secret/secret-init-encryption.in | 11 +++++++++++ src/secret/virtsecretd.service.extra.in | 8 ++++++++ 4 files changed, 34 insertions(+) create mode 100644 src/secret/secret-init-encryption.in diff --git a/libvirt.spec.in b/libvirt.spec.in index 79738bd7bb..fa477db031 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1889,13 +1889,16 @@ exit 0 %pre daemon-driver-secret %libvirt_sysconfig_pre virtsecretd %libvirt_systemd_unix_pre virtsecretd +%libvirt_systemd_oneshot_pre virt-secret-init-encryption =20 %posttrans daemon-driver-secret %libvirt_sysconfig_posttrans virtsecretd %libvirt_systemd_unix_posttrans virtsecretd +%libvirt_systemd_unix_posttrans virt-secret-init-encryption =20 %preun daemon-driver-secret %libvirt_systemd_unix_preun virtsecretd +%libvirt_systemd_unix_preun virt-secret-init-encryption =20 %pre daemon-driver-storage-core %libvirt_sysconfig_pre virtstoraged @@ -2247,9 +2250,13 @@ exit 0 %{_datadir}/augeas/lenses/virtsecretd.aug %{_datadir}/augeas/lenses/tests/test_virtsecretd.aug %{_unitdir}/virtsecretd.service +%{_unitdir}/virt-secret-init-encryption.service %{_unitdir}/virtsecretd.socket %{_unitdir}/virtsecretd-ro.socket %{_unitdir}/virtsecretd-admin.socket +%{_unitdir}/virt-secret-init-encryption.socket +%{_unitdir}/virt-secret-init-encryption-ro.socket +%{_unitdir}/virt-secret-init-encryption-admin.socket %attr(0755, root, root) %{_sbindir}/virtsecretd %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/secrets/ %ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/secrets/ diff --git a/src/secret/meson.build b/src/secret/meson.build index 3b859ea7b4..d8861fcbcd 100644 --- a/src/secret/meson.build +++ b/src/secret/meson.build @@ -42,6 +42,14 @@ if conf.has('WITH_SECRETS') ], } =20 + virt_daemon_units +=3D { + 'service': 'virt-secret-init-encryption', + 'name': 'secret-init-encryption', + 'service_in': files('secret-init-encryption.in'), + 'service_extra_in': [], + 'socket_extra_in': [], + } + openrc_init_files +=3D { 'name': 'virtsecretd', 'in_file': files('virtsecretd.init.in'), diff --git a/src/secret/secret-init-encryption.in b/src/secret/secret-init-= encryption.in new file mode 100644 index 0000000000..4dc00e5bbb --- /dev/null +++ b/src/secret/secret-init-encryption.in @@ -0,0 +1,11 @@ +[Unit] +Before=3Dvirtsecretd.service +ConditionPathExists=3D!/var/lib/libvirt/secrets/secrets-encryption-key + +[Service] +Type=3Doneshot +ExecStart=3D/usr/bin/sh -c 'test -f /var/lib/libvirt/secrets/secrets-encry= ption-key || (dd if=3D/dev/urandom status=3Dnone bs=3D32 count=3D1 | system= d-creds encrypt --name=3Dsecrets-encryption-key - /var/lib/libvirt/secrets/= secrets-encryption-key)' +ExecStart=3D-/usr/bin/chmod 0400 /var/lib/libvirt/secrets/secrets-encrypti= on-key + +[Install] +WantedBy=3Dmulti-user.target diff --git a/src/secret/virtsecretd.service.extra.in b/src/secret/virtsecre= td.service.extra.in index 1fc8c672f7..1df9163814 100644 --- a/src/secret/virtsecretd.service.extra.in +++ b/src/secret/virtsecretd.service.extra.in @@ -1,2 +1,10 @@ # The contents of this unit will be merged into a base template. # Additional units might be merged as well. See meson.build for details. +# +[Unit] +Requires=3Dvirt-secret-init-encryption.service +After=3Dvirt-secret-init-encryption.service + +[Service] +LoadCredentialEncrypted=3Dsecrets-encryption-key:/var/lib/libvirt/secrets/= secrets-encryption-key +Environment=3DSECRETS_ENCRYPTION_KEY=3D%d/secrets-encryption-key --=20 2.51.1