From nobody Thu Feb 12 18:31:39 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1770902013; cv=none; d=zohomail.com; s=zohoarc; b=hmHi12xjfGs71+GwMgo+azdJ2rdzZJtJyixJyYQOO2O3gu40bwsN1U4UuZKlxn3LhafPHBzGJYO/gsULP4zVK6zN+JYvhgan9U7HC0UWdeTXMmomc0YJhcFOnx5bQO3B+Wu005ehyoXsg0DR3m503YAFgnojkes8291c1xE9KCA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1770902013; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:References:Subject:Subject:To:To:Message-Id; bh=jPF+25NsYehcHr5vrklk08W4cdaPdaFZNS1zeswPnos=; b=fEP48pzQPapACDOqV2SCE9gcuDtuxPHaKaF3iN4Y/Gv2nEnbUsK+dpD7HioHVXGpo8ODwSP4OG7DQE+ny3TzML0A9TuRPXj/GC7Qx9DJUGWTE/L9/A/N+hjjgR14VHGE695Z2Lg9godS7xxAUTvM3qsc4HfZq3zG/spTCC2O3/4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1770902013587130.79089378818685; Thu, 12 Feb 2026 05:13:33 -0800 (PST) Received: by lists.libvirt.org (Postfix, from userid 993) id 14E17440B4; Thu, 12 Feb 2026 08:13:33 -0500 (EST) Received: from [172.19.199.6] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id C1A2445A64; Thu, 12 Feb 2026 07:52:33 -0500 (EST) Received: by lists.libvirt.org (Postfix, from userid 993) id 9943D454A7; Thu, 12 Feb 2026 07:51:22 -0500 (EST) Received: from mx1.osci.io (unknown [8.43.85.229]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 33F9445B07 for ; Thu, 12 Feb 2026 07:39:37 -0500 (EST) Received: by mx1.osci.io (Postfix, from userid 995) id 304FD28C82; Tue, 10 Feb 2026 12:56:58 -0500 (EST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mx1.osci.io (Postfix) with ESMTPS id 6904328C80 for ; Tue, 10 Feb 2026 12:56:57 -0500 (EST) Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-517-XreAXhG4Ol-su63KTC4REg-1; Tue, 10 Feb 2026 12:56:52 -0500 Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-81f3f3af760so12699744b3a.1 for ; Tue, 10 Feb 2026 09:56:52 -0800 (PST) Received: from armenon-kvm.armenon-thinkpadp16vgen1.bengluru.csb ([49.36.106.234]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-824418a70fesm13782658b3a.45.2026.02.10.09.56.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 10 Feb 2026 09:56:50 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-5.0 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1770746216; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jPF+25NsYehcHr5vrklk08W4cdaPdaFZNS1zeswPnos=; b=jFNRg9Mtn54/EEMjRW0ZgK1i6RQRMV/UZCzHKoixB8ihbAf3pj6LM8jc+pG06uZLEVbyoB m0y6MPLcdKendeAJMvC+yfB5a7K4oF9TiUIXebrbZfIyQ6KX0gtMER5BwMV2gnFXfb4v3J XGF/uSWeDzFycT6mJyQpaAQAzHBDgtg= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1770746217; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jPF+25NsYehcHr5vrklk08W4cdaPdaFZNS1zeswPnos=; b=Fbl13kUAi54gafO6C8iLQ5A+tXPxSbOc/nJf4s2WTVTjq2OWJAGIhf3x/4hSIswR3UouKo S3zPNJZ4mLxGUHmK0DJTtZrLIR9oB5U2I8Yl+rvReEjj1k3BR9Hrj93LHUviWAderv7aO1 a6V7fgki6IpzhOm1r2Bn7PFoTojqsMU= X-MC-Unique: XreAXhG4Ol-su63KTC4REg-1 X-Mimecast-MFC-AGG-ID: XreAXhG4Ol-su63KTC4REg_1770746212 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1770746211; x=1771351011; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=jPF+25NsYehcHr5vrklk08W4cdaPdaFZNS1zeswPnos=; b=kYTIvAlulba6iXdrUGHd62dxwlCSG32tYi+XdOtkWgVDKjy1JCxv/NjyIuciv9MPrg SganiRd8ngvcQS9tlojFKiSZMD1Ayivvp0PsuejobpPm7Pwng0y2M+eJmeciaa2FYjIH C+eFK+4BsmCCPjLbo4W9d0cWHhl/uSYEXL7c+WnZQ0xQvILkh955bBnYbAPNYTSbNOc7 l8V1LKeJ/+wiOXUh5Grz04iADe/ANFjAWfCGe5odMrfGMvZ8rExgv/ik4975xiL1z47M ZOmFoOZ0pyS80NwRCPd5uhwyIsI8fdKimcwPrI5BgF/uVCOt44vCElLjgP3xgYWwlBTD YK3g== X-Gm-Message-State: AOJu0Yw8Ceap1OCCHZNh/seZoA0iqS/TKo6H6BMORLfoSJpBNBApCeME lc+JB7/XQE1Z48J+NNEHo2txUOnu8hEna8jsB4fbdzz+9/geTTC754KICzTdN3nAyuBGO9mn1Aq zJkyMPm6UBr4d4fVCRcn6tUj9pXwLL1jbXvLjlZOP/Q0qPYv1VQ9q32yLWBLzH2PepSn+6Q7vkf vXHg5CzGByE+9/Oj9Ly5Z16HbVso3WL33ynZo8WekVKQ== X-Gm-Gg: AZuq6aJeGbjNVYrO3Nq61cggw30YUGgEdFNWkB9t1ieI/W7AvMTFUX4J8KQbx6uxx68 2rlB/ZVgRLjRPzUVgj5RmZ+/7N1U02xWTvBWRfn1MRMggztYJcVVRtOjj/ZmjZmX/kvJFl7abrc E15unhhWarlPFUTuUNMrKSjXz+I+B1BUgpStLKtMGT7oNSliYZtgqofUJ9ZzMS3KBPkJDDyKQPH ZQSwio3XBQmCc9DJ3mH0DAJ5XN036EVrxhNblyE7jwubZVO0SQ6kwSrKyMpZNOECZTY0GGNf6jS fdTCwzw5o4B7dKuqq4cU1jHYYBVQXaNxavdApbkrUnd7GexJXsX3l9k8s2AZi3dpHyxnBornkCs yj2DkX+0bz6X2TNFWVE7j+zQRYFq01Mk9812qMwNfr8T+2bxv2wkJM762bqO8GI3NHIdHzw== X-Received: by 2002:aa7:8892:0:b0:823:bbb:76fb with SMTP id d2e1a72fcca58-82487ab3776mr3208785b3a.46.1770746211405; Tue, 10 Feb 2026 09:56:51 -0800 (PST) X-Received: by 2002:aa7:8892:0:b0:823:bbb:76fb with SMTP id d2e1a72fcca58-82487ab3776mr3208767b3a.46.1770746210916; Tue, 10 Feb 2026 09:56:50 -0800 (PST) To: devel@lists.libvirt.org Subject: [PATCH v6 2/6] secret: Set up default encryption secret key for the virtsecretd service Date: Tue, 10 Feb 2026 23:26:39 +0530 Message-ID: <20260210175643.23351-3-armenon@redhat.com> X-Mailer: git-send-email 2.51.1 In-Reply-To: <20260210175643.23351-1-armenon@redhat.com> References: <20260210175643.23351-1-armenon@redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: HD4IHUzVW0ZkOt6UlQAfKplafw7P0vj-3o9ep87w8Hs_1770746212 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Message-ID-Hash: NMD6WLMD6AOQLIQQVUD7E74YLQZF733J X-Message-ID-Hash: NMD6WLMD6AOQLIQQVUD7E74YLQZF733J X-MailFrom: armenon@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Arun Menon X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Arun Menon via Devel Reply-To: Arun Menon X-ZohoMail-DKIM: fail (found 2 invalid signatures) X-ZM-MESSAGEID: 1770902024691154100 Content-Type: text/plain; charset="utf-8"; x-default="true" From: Arun Menon This commit sets the foundation for encrypting the libvirt secrets by provi= ding a secure way to pass a secret encryption key to the virtsecretd service. A random secret key is generated using the new virt-secret-init-encryption service. This key can be consumed by the virtsecretd service. By using the "Before=3D" directive in the new virt-secret-init-encryption service and using "Requires=3D" directive in the virtsecretd service, we make sure that the daemon is run only after we have an encrypted secret key file generated and placed in /var/lib/libvirt/secrets. The virtsecretd service can then read the key from CREDENTIALS_DIRECTORY. [= 1] This setup therefore provides a default key out-of-the-box for initial use. A subsequent commit will introduce the logic for virtsecretd to access and use this key via the $CREDENTIALS_DIRECTORY environment varia= ble. [2] [1] https://www.freedesktop.org/software/systemd/man/latest/systemd-creds.h= tml [2] https://systemd.io/CREDENTIALS/ Signed-off-by: Arun Menon Reviewed-by: Peter Krempa --- libvirt.spec.in | 5 +++++ src/meson.build | 1 + src/remote/libvirtd.service.in | 4 ++++ src/secret/meson.build | 13 +++++++++++++ src/secret/virt-secret-init-encryption.service.in | 8 ++++++++ src/secret/virtsecretd.service.extra.in | 8 ++++++++ 6 files changed, 39 insertions(+) create mode 100644 src/secret/virt-secret-init-encryption.service.in diff --git a/libvirt.spec.in b/libvirt.spec.in index 22c9975d9f..34a47d689c 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1891,13 +1891,16 @@ exit 0 %pre daemon-driver-secret %libvirt_sysconfig_pre virtsecretd %libvirt_systemd_unix_pre virtsecretd +%libvirt_systemd_oneshot_pre virt-secret-init-encryption =20 %posttrans daemon-driver-secret %libvirt_sysconfig_posttrans virtsecretd %libvirt_systemd_unix_posttrans virtsecretd +%libvirt_systemd_unix_posttrans virt-secret-init-encryption =20 %preun daemon-driver-secret %libvirt_systemd_unix_preun virtsecretd +%libvirt_systemd_unix_preun virt-secret-init-encryption =20 %pre daemon-driver-storage-core %libvirt_sysconfig_pre virtstoraged @@ -2249,11 +2252,13 @@ exit 0 %{_datadir}/augeas/lenses/virtsecretd.aug %{_datadir}/augeas/lenses/tests/test_virtsecretd.aug %{_unitdir}/virtsecretd.service +%{_unitdir}/virt-secret-init-encryption.service %{_unitdir}/virtsecretd.socket %{_unitdir}/virtsecretd-ro.socket %{_unitdir}/virtsecretd-admin.socket %attr(0755, root, root) %{_sbindir}/virtsecretd %dir %attr(0700, root, root) %{_sysconfdir}/libvirt/secrets/ +%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/secrets/ %ghost %dir %attr(0700, root, root) %{_rundir}/libvirt/secrets/ %{_libdir}/libvirt/connection-driver/libvirt_driver_secret.so %{_mandir}/man8/virtsecretd.8* diff --git a/src/meson.build b/src/meson.build index 16875622f4..cab52ce7a3 100644 --- a/src/meson.build +++ b/src/meson.build @@ -833,6 +833,7 @@ if conf.has('WITH_LIBVIRTD') 'sbindir': sbindir, 'sysconfdir': sysconfdir, 'initconfdir': initconfdir, + 'localstatedir': localstatedir, 'name': unit['name'], 'service': unit['service'], 'SERVICE': unit['service'].to_upper(), diff --git a/src/remote/libvirtd.service.in b/src/remote/libvirtd.service.in index b0a062e885..7965010a0a 100644 --- a/src/remote/libvirtd.service.in +++ b/src/remote/libvirtd.service.in @@ -12,6 +12,8 @@ After=3Dlibvirtd.socket After=3Dlibvirtd-ro.socket After=3Dlibvirtd-admin.socket Requires=3Dvirtlogd.socket +Requires=3Dvirt-secret-init-encryption.service +After=3Dvirt-secret-init-encryption.service Wants=3Dvirtlockd.socket After=3Dvirtlogd.socket After=3Dvirtlockd.socket @@ -29,6 +31,8 @@ Conflicts=3Dxendomains.service Type=3Dnotify-reload Environment=3DLIBVIRTD_ARGS=3D"--timeout 120" EnvironmentFile=3D-@initconfdir@/libvirtd +Environment=3DSECRETS_ENCRYPTION_KEY=3D%d/secrets-encryption-key +LoadCredentialEncrypted=3Dsecrets-encryption-key:@localstatedir@/lib/libvi= rt/secrets/secrets-encryption-key ExecStart=3D@sbindir@/libvirtd $LIBVIRTD_ARGS ExecReload=3D/bin/kill -HUP $MAINPID KillMode=3Dprocess diff --git a/src/secret/meson.build b/src/secret/meson.build index 3b859ea7b4..b69abe32ab 100644 --- a/src/secret/meson.build +++ b/src/secret/meson.build @@ -31,6 +31,18 @@ if conf.has('WITH_SECRETS') 'name': 'virtsecretd', } =20 + virt_secret_init_encryption_conf =3D configuration_data() + + virt_secret_init_encryption_conf.set('localstatedir', localstatedir) + + configure_file( + input: 'virt-secret-init-encryption.service.in', + output: '@0@.service'.format('virt-secret-init-encryption'), + configuration: virt_secret_init_encryption_conf, + install: true, + install_dir: unitdir, + ) + virt_daemon_units +=3D { 'service': 'virtsecretd', 'name': 'secret', @@ -50,5 +62,6 @@ if conf.has('WITH_SECRETS') virt_install_dirs +=3D [ confdir / 'secrets', runstatedir / 'libvirt' / 'secrets', + localstatedir / 'lib' / 'libvirt' / 'secrets', ] endif diff --git a/src/secret/virt-secret-init-encryption.service.in b/src/secret= /virt-secret-init-encryption.service.in new file mode 100644 index 0000000000..8fd54002a0 --- /dev/null +++ b/src/secret/virt-secret-init-encryption.service.in @@ -0,0 +1,8 @@ +[Unit] +Before=3Dvirtsecretd.service +Before=3Dlibvirtd.service +ConditionPathExists=3D!@localstatedir@/lib/libvirt/secrets/secrets-encrypt= ion-key + +[Service] +Type=3Doneshot +ExecStart=3D/usr/bin/sh -c 'umask 0077 && (dd if=3D/dev/random status=3Dno= ne bs=3D32 count=3D1 | systemd-creds encrypt --name=3Dsecrets-encryption-ke= y - @localstatedir@/lib/libvirt/secrets/secrets-encryption-key)' diff --git a/src/secret/virtsecretd.service.extra.in b/src/secret/virtsecre= td.service.extra.in index 1fc8c672f7..116458b22a 100644 --- a/src/secret/virtsecretd.service.extra.in +++ b/src/secret/virtsecretd.service.extra.in @@ -1,2 +1,10 @@ # The contents of this unit will be merged into a base template. # Additional units might be merged as well. See meson.build for details. +# +[Unit] +Requires=3Dvirt-secret-init-encryption.service +After=3Dvirt-secret-init-encryption.service + +[Service] +LoadCredentialEncrypted=3Dsecrets-encryption-key:@localstatedir@/lib/libvi= rt/secrets/secrets-encryption-key +Environment=3DSECRETS_ENCRYPTION_KEY=3D%d/secrets-encryption-key --=20 2.51.1