<div dir="ltr"><div><div>Thanks Joel. I was able to try this again and can confirm it works as you describe. Cool.<br><br></div>Based on the comments to the RBD encryption change [1], it looks like there will be a new direction for ephemeral disk encryption (embedding it in QEMU directly). I assume LVM will work the same way when the time comes. Will there be a migration path for the existing ephemeral disk encryption support for LVM to the new model?<br><br><br></div>-Chris<br><br>[1] <a href="https://review.openstack.org/#/c/239798/">https://review.openstack.org/#/c/239798/</a><br><br><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 14, 2016 at 12:56 PM, Coffman, Joel M. <span dir="ltr"><<a href="mailto:Joel.Coffman@jhuapl.edu" target="_blank">Joel.Coffman@jhuapl.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0)">
<div style="font-size:14px;font-family:Calibri,sans-serif"><span class="">
<div><font color="#1f497d">> Upon reading the source, I don't see "cryptsetup luksFormat" being called anywhere (nova/libvirt/storage/*).</font></div>
</span><span class=""><div>Check out <a href="https://github.com/openstack/nova/blob/master/nova/virt/libvirt/imagebackend.py#L690" target="_blank">imagebackend.py:Lvm.create_image</a> and <a href="https://github.com/openstack/nova/blob/master/nova/virt/libvirt/storage/dmcrypt.py#L48" target="_blank">dmcrypt.py:create_volume</a>.</div>
<div><br>
</div>
</span><span class=""><div><font color="#1f497d">> How is this feature envisioned to work?</font></div>
</span></div>
<div style="font-size:14px;font-family:Calibri,sans-serif">The LVM volume with the '-dmcrypt' suffix is the
<i>unencrypted</i> device that is passed to the VM. From a DevStack machine with an encrypted instance:</div>
<div>
<p style="margin:0px"><font style="font-size:12px" face="Courier"><b>$</b> sudo cryptsetup status /dev/mapper/065859b2-50d6-46d6-927a-2dfd07db3306_disk-dmcrypt</font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier">/dev/mapper/065859b2-50d6-46d6-927a-2dfd07db3306_disk-dmcrypt is active and is in use.</font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier"> type: PLAIN</font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier"> cipher: aes-xts-plain64</font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier"> keysize: 256 bits</font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier"> device: /dev/mapper/stack--volumes--default-065859b2--50d6--46d6--927a--2dfd07db3306_disk</font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier"> offset: 0 sectors</font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier"> size: 2097152 sectors</font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier"> mode: read/write</font></p>
</div>
<div>
<p style="margin:0px"><font style="font-size:12px" face="Courier"><b>$</b> sudo fuser -vam /dev/mapper/065859b2-50d6-46d6-927a-2dfd07db3306_disk-dmcrypt </font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier"> USER PID ACCESS COMMAND</font></p>
<p style="margin:0px"><font style="font-size:12px" face="Courier">/dev/dm-1: libvirt-qemu 8429 F.... qemu-system-x86</font></p>
</div>
<div style="font-size:14px;font-family:Calibri,sans-serif">While information in the '*-dmcrypt' device is visible to a root user on the compute host, the underlying device (stack--volumes--default-* in the example above) is encrypted, and everything written
to the underlying disk is also encrypted. Try searching for the text in the underlying device – you shouldn't be able to find it.</div>
<div style="font-size:14px;font-family:Calibri,sans-serif"><br>
</div>
<div style="font-size:14px;font-family:Calibri,sans-serif">Joel</div>
<div style="font-size:14px;font-family:Calibri,sans-serif"><br>
</div>
<div style="font-size:14px;font-family:Calibri,sans-serif"><br>
</div>
<span style="font-size:14px;font-family:Calibri,sans-serif">
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Chris Buccella <<a href="mailto:chris.buccella@verilume.com" target="_blank">chris.buccella@verilume.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>"<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Date: </span>Monday, April 11, 2016 at 1:06 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>[openstack-dev] [nova] Encrypted Ephemeral Storage<br>
</div><div><div class="h5">
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div>
<div>
<div>
<div>I've been looking into using encrypted ephemeral storage with LVM. With the [ephemeral_storage_encryption] and [keymgr] sections to nova.conf, I get an LVM volume with "-dmcrypt" is appended to the volume name, but otherwise see no difference; I can still
grep for text inside the volume.<br>
<br>
Upon reading the source, I don't see "cryptsetup luksFormat" being called anywhere (nova/libvirt/storage/*).
<br>
</div>
<br>
I was expecting a new encrypted LVM volume when a new instance was created. Are my expectations misplaced? How is this feature envisioned to work?<br>
<br>
<br>
</div>
<div>Thanks,<br>
<br>
</div>
<div>-Chris<br>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></span>
</div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>