On 21/01/26 16:23, Arun Menon wrote:
> On Fri, Jan 09, 2026 at 11:39:30PM +0530, Arun Menon wrote:
>> Libvirt secrets are stored unencrypted on the disk.
>> With this series we want to start encrypting the secrets.
>>
>> 1. Introduce the GnuTLS decryption wrapper functions that
>> work exact opposite to the encryption wrappers.
>>
>> 2. Add a new service called virt-secrets-init-encryption, that is
>> linked to the virtsecretd service. virtsecretd service only starts
>> after the new service generates a random encryption key.
>>
>> 3. Add a new secrets.conf configuration file that helps user to set
>> a. secrets_encryption_key - allows the user to specify the encryption
>> key file path, in case the default key is not to be used.
>> b. encrypt_data - set to 0 or 1. If set to 1, then the newly
>> added secrets will be encrypted.
>>
>> 4. Add encryption scheme or cipher attribute that will allow us to
>> choose the last used cipher.
>>
>> 5. Once we have the encryption key, and a reliable way to tell the daemon
>> what encryption scheme the secret object is using, we can encrypt the
>> secrets on disk and store them in <uuid>.<encryption_scheme> format.
>> It is important to note that if the encryption key is changed between
>> restarts, then the respective secret will not be loaded by the driver.
>>
>> 6. Add documentation.
>>
>> This is a sincere attempt to improve upon the already submitted patch
>> https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6GVZQ45JTYFTE54CT7DMONSO2W3ZPV/
>>
>> Resolves:https://issues.redhat.com/browse/RHEL-7125
>>
>> ---
>>
>> Changes in v3:
> v4
>> - Fix the regression of loading unencrypted secrets after an upgrade.
>> Previously the .base64 unencrypted secrets were not being loaded.
>> - Add documentation on encrypted secrets.
>>
>> Changes in v3:
>> - Secrets xml configuration no longer stores the encryption scheme, therefore
>> not allowing the user to toggle between ciphers.
>> - Removed unnecessary socket files of the new service. It now has a general
>> configuration with which it starts.
>> - Addressed review comments from Peter on coding style and design.
>> - Loading of secrets is dependent on the file extension. Most recent cipher is
>> used while saving the secrets.
>>
>> Changes in v2:
>> - Corrected the encryption key length check. It should be 32.
>> - Added a new patch that introduces the encryption scheme attribute.
>> This will help us identify which secrets are encrypted.
>> - A new systemd unit service file added that starts before virtsecretd, helping
>> us to construct a random encryption key and pass it to the virtsecretd service.
>> - Parsing logic of secrets.conf moved to a separate file.
>> - Spec file changes, augeas.
>>
>> Arun Menon (6):
>> util: Add support for GnuTLS decryption
>> secret: Set up default encryption secret key for the virtsecretd
>> service
>> secret: Add secret.conf configuration file and parse it
>> secret: Rename virSecretObj structure attribute from base64File to
>> secretValueFile
>> secret: Add functionality to load and save secrets in encrypted format
>> docs: secret: Add documentation of secret encryption feature
>>
>> docs/drvsecret.rst | 4 +
>> docs/meson.build | 1 +
>> docs/secretencryption.rst | 86 ++++++++
>> include/libvirt/virterror.h | 1 +
>> libvirt.spec.in | 8 +
>> po/POTFILES | 1 +
>> src/conf/virsecretobj.c | 193 ++++++++++++++----
>> src/conf/virsecretobj.h | 18 +-
>> src/libvirt_private.syms | 1 +
>> src/meson.build | 1 +
>> src/remote/libvirtd.service.in | 4 +
>> src/secret/libvirt_secrets.aug | 40 ++++
>> src/secret/meson.build | 32 +++
>> src/secret/secret.conf.in | 14 ++
>> src/secret/secret_config.c | 179 ++++++++++++++++
>> src/secret/secret_config.h | 40 ++++
>> src/secret/secret_driver.c | 34 ++-
>> src/secret/test_libvirt_secrets.aug.in | 6 +
>> .../virt-secret-init-encryption.service.in | 8 +
>> src/secret/virtsecretd.service.extra.in | 8 +
>> src/util/vircrypto.c | 126 +++++++++++-
>> src/util/vircrypto.h | 8 +
>> src/util/virerror.c | 3 +
>> tests/vircryptotest.c | 65 ++++++
>> 24 files changed, 831 insertions(+), 50 deletions(-)
>> create mode 100644 docs/secretencryption.rst
>> create mode 100644 src/secret/libvirt_secrets.aug
>> create mode 100644 src/secret/secret.conf.in
>> create mode 100644 src/secret/secret_config.c
>> create mode 100644 src/secret/secret_config.h
>> create mode 100644 src/secret/test_libvirt_secrets.aug.in
>> create mode 100644 src/secret/virt-secret-init-encryption.service.in
>>
>> --
>> 2.51.1
>>
> Hello,
>
> A gentle ping on this series.
> Any further suggestion is appreciated.
>
>
> Regards,
> Arun Menon
Hi,
Friendly ping on this series.
Please let me know if there is any additional feedback.
--
Regards,
Arun Menon