Libvirt secrets are stored unencrypted on the disk.
With this series we want to start encrypting the secrets.

1. Introduce the GnuTLS decryption wrapper functions that
   work exact opposite to the encryption wrappers.

2. Add a new service called virt-secrets-init-encryption, that is
   linked to the virtsecretd service. virtsecretd service only starts
   after the new service generates a random encryption key.

3. Add a new secrets.conf configuration file that helps user to set
   a. secrets_encryption_key - allows the user to specify the encryption
      key file path, in case the default key is not to be used.
   b. encrypt_data - set to 0 or 1. If set to 1, then the newly
      added secrets will be encrypted.

4. Add encryption scheme or cipher attribute that will allow us to
   choose the last used cipher.

5. Once we have the encryption key, and a reliable way to tell the daemon
   what encryption scheme the secret object is using, we can encrypt the
   secrets on disk and store them in <uuid>.<encryption_scheme> format.
   It is important to note that if the encryption key is changed between
   restarts, then the respective secret will not be loaded by the driver.

6. Add documentation.

This is a sincere attempt to improve upon the already submitted patch
https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/KE6GVZQ45JTYFTE54CT7DMONSO2W3ZPV/

Resolves: https://issues.redhat.com/browse/RHEL-7125

---
Changes in v5:
- Fix the bug of updating old secrets, prior to 12.1.0. Old secrets,
  when updated, now are stored with the latest encryption scheme if
  encryption is on.
- Remove any logic in setting the secretValueFile in virSecretObjListAdd.
  Move it to virSecretLoadValue and virSecretObjSetValue.
- Change urandom to random. Change default permission bits to 0077.
- Update the documentation.

Changes in v4:
- Fix the regression of loading unencrypted secrets after an upgrade.
  Previously the .base64 unencrypted secrets were not being loaded.
- Add documentation on encrypted secrets.

Changes in v3:
- Secrets xml configuration no longer stores the encryption scheme, therefore
  not allowing the user to toggle between ciphers.
- Removed unnecessary socket files of the new service. It now has a general
  configuration with which it starts.
- Addressed review comments from Peter on coding style and design.
- Loading of secrets is dependent on the file extension. Most recent cipher is
  used while saving the secrets.

Changes in v2:
- Corrected the encryption key length check. It should be 32.
- Added a new patch that introduces the encryption scheme attribute.
  This will help us identify which secrets are encrypted.
- A new systemd unit service file added that starts before virtsecretd, helping
  us to construct a random encryption key and pass it to the virtsecretd service.
- Parsing logic of secrets.conf moved to a separate file.
- Spec file changes, augeas.

Arun Menon (6):
  util: Add support for GnuTLS decryption
  secret: Set up default encryption secret key for the virtsecretd
    service
  secret: Add secret.conf configuration file and parse it
  secret: Rename virSecretObj structure attribute from base64File to
    secretValueFile
  secret: Add functionality to load and save secrets in encrypted format
  docs: secret: Add documentation of secret encryption feature

 docs/drvsecret.rst                            |   4 +
 docs/meson.build                              |   1 +
 docs/secretencryption.rst                     | 105 +++++++
 include/libvirt/virterror.h                   |   1 +
 libvirt.spec.in                               |   8 +
 po/POTFILES                                   |   1 +
 src/conf/virsecretobj.c                       | 259 +++++++++++++-----
 src/conf/virsecretobj.h                       |  16 +-
 src/libvirt_private.syms                      |   1 +
 src/meson.build                               |   1 +
 src/remote/libvirtd.service.in                |   4 +
 src/secret/libvirt_secrets.aug                |  40 +++
 src/secret/meson.build                        |  32 +++
 src/secret/secret.conf.in                     |  14 +
 src/secret/secret_config.c                    | 179 ++++++++++++
 src/secret/secret_config.h                    |  40 +++
 src/secret/secret_driver.c                    |  31 ++-
 src/secret/test_libvirt_secrets.aug.in        |   6 +
 .../virt-secret-init-encryption.service.in    |   8 +
 src/secret/virtsecretd.service.extra.in       |   8 +
 src/util/vircrypto.c                          | 126 ++++++++-
 src/util/vircrypto.h                          |   8 +
 src/util/virerror.c                           |   3 +
 tests/vircryptotest.c                         |  65 +++++
 24 files changed, 892 insertions(+), 69 deletions(-)
 create mode 100644 docs/secretencryption.rst
 create mode 100644 src/secret/libvirt_secrets.aug
 create mode 100644 src/secret/secret.conf.in
 create mode 100644 src/secret/secret_config.c
 create mode 100644 src/secret/secret_config.h
 create mode 100644 src/secret/test_libvirt_secrets.aug.in
 create mode 100644 src/secret/virt-secret-init-encryption.service.in

-- 
2.51.1