<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> </head> <body> <style> font{ line-height: 1.6; } ul,ol{ padding-left: 20px; list-style-position: inside; } </style> <div style="font-family:微软雅黑,Verdana,"Microsoft Yahei",SimSun,sans-serif;font-size:14px; line-height:1.6;"> <div></div><div> <div> </div> <div> <ul style="box-sizing: border-box; margin: 0px; padding: 0px; widows: auto; background-color: rgb(247, 248, 250);"><li style="color: rgb(46, 48, 51); font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 14px; box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">Hey, guys</li><li style="color: rgb(46, 48, 51); font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 14px; box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">I've been working on whether libvirt supports encrypted snapshots,Here are my versions of libvirt and qemu</li><li style="color: rgb(46, 48, 51); font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 14px; box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">[root@xx ~]# libvirtd -V</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">libvirtd (libvirt) 4.5.0[root@xx ~]# qemu-img -Vqemu-img version 2.12.0 (qemu-kvm-ev-2.12.0-33.1.el7_7.4)Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">1. assign $MYSECRET to libvirt secret using the secret-define and secret-set-value commands,and $MYSECRET is in base64 format</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">MYSECRET=`printf %s "123456" | base64`</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">2. created a disk encrypted in luks format</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;"><code class="hljs" style="font-size: 11.9px; line-height: inherit; orphans: 2; widows: 2; color: rgb(51, 51, 51); box-sizing: border-box; display: inline; overflow: visible; padding: 0px; font-family: SFMono-Regular, Consolas, 'Liberation Mono', Menlo, Courier, monospace, sans-serif; margin: 0px; border-radius: 3px; word-break: normal; border: 0px; border-image-source: initial; border-image-slice: initial; border-image-width: initial; border-image-outset: initial; border-image-repeat: initial; word-wrap: normal; background-image: initial; background-attachment: initial; background-color: transparent; background-size: initial; background-origin: initial; background-clip: initial; background-position: initial; background-repeat: initial;">qemu-img create --object secret,id=sec0,data=$MYSECRET,format=base64 -f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 enc.qcow2 </code><code class="hljs" style="font-size: 11.9px; line-height: inherit; orphans: 2; widows: 2; color: rgb(0, 0, 0); box-sizing: border-box; display: inline; overflow: visible; padding: 0px; font-family: SFMono-Regular, Consolas, 'Liberation Mono', Menlo, Courier, monospace, sans-serif; margin: 0px; border-radius: 3px; word-break: normal; border: 0px; border-image-source: initial; border-image-slice: initial; border-image-width: initial; border-image-outset: initial; border-image-repeat: initial; word-wrap: normal; background-image: initial; background-attachment: initial; background-color: transparent; background-size: initial; background-origin: initial; background-clip: initial; background-position: initial; background-repeat: initial;">20G</code></li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">3. <span data-group="0-0" class="transSent highlight" style="widows: auto; box-sizing: border-box; color: rgb(74, 144, 226); font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 26px;">The encrypted disk is defined in the XML configuration file, as shown below.<span data-group="0-1" class="transSent" style="widows: auto; box-sizing: border-box; color: rgb(51, 51, 51); font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 26px;">Then I successfully started the virtual machine.</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;"><disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/root/enc.qcow2'/> <backingStore/> <target dev='hda' bus='ide'/> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> <alias name='ide0-0-0'/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk></li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">4. According to the qemu documentation, an encrypted snap.qcow2 disk was created with enc.qcow2 as backing</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">qemu-img create -f qcow2 -F qcow2 --object secret,id=sec0,data=$MYSECRET,format=base64 --object secret,id=sec1,data=$MYSECRET,format=base64 -o encrypt.format=luks,encrypt.key-secret=sec1 -b 'json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root/enc/enc.qcow2"}}' snap.qcow2</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">I used the same $MYSECRET as the password data for the disk. Here is the disk information for snap.qcow2</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">image: snap.qcow2file format: qcow2virtual size: 20G (21474836480 bytes)disk size: 480Kencrypted: yescluster_size: 65536backing file: json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root//enc.qcow2"}}backing file format: qcow2Format specific information: compat: 1.1 lazy refcounts: false refcount bits: 16 encrypt: ivgen alg: plain64 hash alg: sha256 cipher alg: aes-256 uuid: ab0e3f87-35e7-40cb-9888-9fe9bb54e981 format: luks cipher mode: xts slots: [0]: active: true iters: 115582 key offset: 4096 stripes: 4000 [1]: active: false key offset: 262144 [2]: active: false key offset: 520192 [3]: active: false key offset: 778240 [4]: active: false key offset: 1036288 [5]: active: false key offset: 1294336 [6]: active: false key offset: 1552384 [7]: active: false key offset: 1810432 payload offset: 2068480 master key iters: 30085 corrupt: false</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;"><div>5. <span data-group="0-0" class="transSent" style="widows: auto; box-sizing: border-box; color: rgb(51, 51, 51); font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 26px;">Then I changed the configuration of the XML, as shown below.<span data-group="0-1" class="transSent" style="widows: auto; box-sizing: border-box; color: rgb(51, 51, 51); font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 26px;">And re-define and start the virtual machine</div></li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;"><div style=""><div><disk type='file' device='disk'></div><div> <driver name='qemu' type='qcow2'/></div><div> <source file='/root/snap.qcow2'/></div><div> <backingStore type='file'></div><div> <format type='qcow2'/></div><div> <source file='/root/enc.qcow2'/></div><div> <backingStore/></div><div> </backingStore></div><div> <target dev='hda' bus='ide'/></div><div> <encryption format='luks'></div><div> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/></div><div> </encryption></div><div> <address type='drive' controller='0' bus='0' target='0' unit='0'/></div><div> </disk></div></div></li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;"><div><ul style="box-sizing: border-box; margin: 0px; padding: 0px; color: rgb(46, 48, 51); font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 14px; widows: auto;"><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">Then the startup failed and an error was thrown. As shown below.</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">qemu-kvm: -drive file=/root/enc/vm/enc-snap.qcow2,encrypt.format=luks,encrypt.key-secret=ide0-0-0-luks-secret0,format=qcow2,if=none,id=drive-ide0-0-0: Could not open backing file: No secret with id 'sec0'</li></ul></div></li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;"><ul style="box-sizing: border-box; margin: 0px; padding: 0px; font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 14px; widows: auto;"><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;"><ul style="box-sizing: border-box; margin: 0px; padding: 0px; widows: auto;"><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">The sec0 secret id could not be found in the backing file, this is my problem.</li></ul></li></ul></li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;">Is there a problem with the way I implemented it, or does libvirt currently not support this?</li><li style="box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;"><div>Any tips or help will be appreciated, Looking forward to your reply. Thank you</div></li><li style="color: rgb(46, 48, 51); font-family: Arial, 'Microsoft YaHei', '\\5FAE软雅黑', '\\5B8B体', 'Malgun Gothic', Meiryo, sans-serif; line-height: 14px; box-sizing: border-box; margin: 0px 0px 10px; padding: 0px; list-style: none;"> </li></ul> </div> <div id="ntes-pcmac-signature" style="font-family:'微软雅黑'"> <div style="font-size:14px; padding: 0; margin:0;line-height:14px;"> <div style="padding-bottom:6px;margin-bottom:10px;border-bottom:1px solid #e6e6e6;display:inline-block;"> <a href="https://maas.mail.163.com/dashi-web-extend/html/proSignature.html?ftlId=1&name=18781374080&uid=18781374080%40163.com&iconUrl=https%3A%2F%2Fmail-online.nosdn.127.net%2Fsm6e287e97618fd71a7263effdae381085.jpg&items=%5B%2218781374080%40163.com%22%5D" style="display:block;background:#fff; max-width: 400px; _width: 400px;padding:15px 0 10px 0;text-decoration: none; outline:none;-webkit-tap-highlight-color:transparent;-webkit-text-size-adjust:none !important;text-size-adjust:none !important;"> <table cellpadding="0" style="width: 100%; max-width: 100%; table-layout: fixed; border-collapse: collapse;color: #9b9ea1;font-size: 14px;line-height:1.3;-webkit-text-size-adjust:none !important;text-size-adjust:none !important;"> <tbody style="font-family: 'PingFang SC', 'Hiragino Sans GB','WenQuanYi Micro Hei', 'Microsoft Yahei', '微软雅黑', verdana !important; word-wrap:break-word; word-break:break-all;-webkit-text-size-adjust:none !important;text-size-adjust:none !important;"> <tr class="firstRow"> <td width="38" style="padding:0; box-sizing: border-box; width: 38px;"> <img width="38" height="38" style="vertical-align:middle; width: 38px; height: 38px; border-radius:50%;" src="https://mail-online.nosdn.127.net/sm6e287e97618fd71a7263effdae381085.jpg"> </td> <td style="padding: 0 0 0 10px; color: #31353b;"> <div style="font-size: 16px;font-weight:bold; width:100%; white-space: nowrap; overflow:hidden;text-overflow: ellipsis;">18781374080</div> </td> </tr> <tr width="100%" style="font-size: 14px !important; width: 100%;"> <td colspan="2" style="padding:10px 0 0 0; font-size:14px !important; width: 100%;"> <div style="width: 100%;font-size: 14px !important;word-wrap:break-word;word-break:break-all;">18781374080@163.com</div> </td> </tr> </tbody> </table> </a> </div> </div> <div style="font-size:12px;color:#b5b9bd;line-height:18px;"> 签名由 <a style="text-decoration: none;color:#4196ff;padding:0 5px;" href="https://mail.163.com/dashi/dlpro.html?from=mail81">网易邮箱大师</a> 定制 </div> </div> </div> </div> </body> </html>