[PATCH 14/19] conf: Add new secret type "key"

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Add a new secret type known as "key" - it will handle adding the secret
objects that need a key (or passphrase), such as will soon be the case
for a luks volume for both storage driver create and libvirt domain usage.

Signed-off-by: John Ferlan <jferlan@xxxxxxxxxx>
---
 docs/aclpolkit.html.in              |  4 +++
 docs/formatsecret.html.in           | 57 +++++++++++++++++++++++++++++++++++--
 docs/schemas/secret.rng             | 10 +++++++
 include/libvirt/libvirt-secret.h    |  3 +-
 src/access/viraccessdriverpolkit.c  | 13 +++++++++
 src/conf/secret_conf.c              | 26 ++++++++++++++++-
 src/conf/secret_conf.h              |  1 +
 src/conf/virsecretobj.c             |  5 ++++
 tests/secretxml2xmlin/usage-key.xml |  7 +++++
 tests/secretxml2xmltest.c           |  1 +
 10 files changed, 123 insertions(+), 4 deletions(-)
 create mode 100644 tests/secretxml2xmlin/usage-key.xml

diff --git a/docs/aclpolkit.html.in b/docs/aclpolkit.html.in
index dae0814..6b7a237 100644
--- a/docs/aclpolkit.html.in
+++ b/docs/aclpolkit.html.in
@@ -224,6 +224,10 @@
           <td>secret_usage_target</td>
           <td>Name of the associated iSCSI target, if any</td>
         </tr>
+        <tr>
+          <td>secret_usage_luks</td>
+          <td>Name of the associated luks volume, if any</td>
+        </tr>
       </tbody>
     </table>
 
diff --git a/docs/formatsecret.html.in b/docs/formatsecret.html.in
index 599cb38..3bb810a 100644
--- a/docs/formatsecret.html.in
+++ b/docs/formatsecret.html.in
@@ -41,8 +41,9 @@
       <dd>
         Specifies what this secret is used for.  A mandatory
         <code>type</code> attribute specifies the usage category, currently
-        only <code>volume</code>, <code>ceph</code> and <code>iscsi</code>
-        are defined. Specific usage categories are described below.
+        only <code>volume</code>, <code>ceph</code>, <code>iscsi</code>,
+        and <code>key</code> are defined. Specific usage categories
+        are described below.
       </dd>
     </dl>
 
@@ -241,5 +242,57 @@
         &lt;secret usage='libvirtiscsi'/&gt;
       &lt;/auth&gt;
     </pre>
+
+    <h3><a name="keyUsageType">Usage type "key"</a></h3>
+
+    <p>
+      This secret is a general purpose secret to be used by various libvirt
+      objects to provide a single key (or passphrase) as required by the
+      object in order to perform its authentication.
+      <span class="since">Since 1.3.6</span>. The following is an example
+      of a key-secret.xml file:
+    </p>
+
+    <pre>
+      # cat key-secret.xml
+      &lt;secret ephemeral='no' private='yes'&gt;
+         &lt;description&gt;sample key secret&lt;/description&gt;
+         &lt;usage type='key'&gt;
+            &lt;key&gt;key_example&lt;/key&gt;
+         &lt;/usage&gt;
+      &lt;/secret&gt;
+
+      # virsh secret-define key-secret.xml
+      Secret 718c71bd-67b5-4a2b-87ec-a24e8ca200dc created
+
+      # virsh secret-list
+      UUID                                 Usage
+      -----------------------------------------------------------
+       718c71bd-67b5-4a2b-87ec-a24e8ca200dc  key key_example
+      #
+
+    </pre>
+
+    <p>
+      A secret may also be defined via the
+      <a href="html/libvirt-libvirt-secret.html#virSecretDefineXML">
+       <code>virSecretDefineXML</code></a> API.
+
+      Once the secret is defined, a secret value will need to be set. This
+      value would be the same used to create and use the volume.
+      The following is a simple example of using
+      <code>virsh secret-set-value</code> to set the secret value. The
+      <a href="html/libvirt-libvirt-secret.html#virSecretSetValue">
+      <code>virSecretSetValue</code></a> API may also be used to set
+      a more secure secret without using printable/readable characters.
+    </p>
+
+    <pre>
+      # MYSECRET=`printf %s "letmein" | base64`
+      # virsh secret-set-value 718c71bd-67b5-4a2b-87ec-a24e8ca200dc $MYSECRET
+      Secret value set
+
+    </pre>
+
   </body>
 </html>
diff --git a/docs/schemas/secret.rng b/docs/schemas/secret.rng
index e21e700..3d131eb 100644
--- a/docs/schemas/secret.rng
+++ b/docs/schemas/secret.rng
@@ -36,6 +36,7 @@
               <ref name='usagevolume'/>
               <ref name='usageceph'/>
               <ref name='usageiscsi'/>
+              <ref name='usagekey'/>
               <!-- More choices later -->
             </choice>
           </element>
@@ -71,4 +72,13 @@
     </element>
   </define>
 
+  <define name='usagekey'>
+    <attribute name='type'>
+      <value>key</value>
+    </attribute>
+    <element name='key'>
+      <ref name='genericName'/>
+    </element>
+  </define>
+
 </grammar>
diff --git a/include/libvirt/libvirt-secret.h b/include/libvirt/libvirt-secret.h
index 3e5cdf6..fadf811 100644
--- a/include/libvirt/libvirt-secret.h
+++ b/include/libvirt/libvirt-secret.h
@@ -4,7 +4,7 @@
  * Description: Provides APIs for the management of secrets
  * Author: Daniel Veillard <veillard@xxxxxxxxxx>
  *
- * Copyright (C) 2006-2014 Red Hat, Inc.
+ * Copyright (C) 2006-2014, 2016 Red Hat, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ -43,6 +43,7 @@ typedef enum {
     VIR_SECRET_USAGE_TYPE_VOLUME = 1,
     VIR_SECRET_USAGE_TYPE_CEPH = 2,
     VIR_SECRET_USAGE_TYPE_ISCSI = 3,
+    VIR_SECRET_USAGE_TYPE_KEY = 4,
 
 # ifdef VIR_ENUM_SENTINELS
     VIR_SECRET_USAGE_TYPE_LAST
diff --git a/src/access/viraccessdriverpolkit.c b/src/access/viraccessdriverpolkit.c
index 89bc890..97419df 100644
--- a/src/access/viraccessdriverpolkit.c
+++ b/src/access/viraccessdriverpolkit.c
@@ -338,6 +338,19 @@ virAccessDriverPolkitCheckSecret(virAccessManagerPtr manager,
                                           virAccessPermSecretTypeToString(perm),
                                           attrs);
     }   break;
+    case VIR_SECRET_USAGE_TYPE_KEY: {
+        const char *attrs[] = {
+            "connect_driver", driverName,
+            "secret_uuid", uuidstr,
+            "secret_usage_key", secret->usage.key,
+            NULL,
+        };
+
+        return virAccessDriverPolkitCheck(manager,
+                                          "secret",
+                                          virAccessPermSecretTypeToString(perm),
+                                          attrs);
+    }   break;
     }
 }
 
diff --git a/src/conf/secret_conf.c b/src/conf/secret_conf.c
index de9e6cf..ccda2c3 100644
--- a/src/conf/secret_conf.c
+++ b/src/conf/secret_conf.c
@@ -29,6 +29,7 @@
 #include "viralloc.h"
 #include "secret_conf.h"
 #include "virsecretobj.h"
+#include "virstring.h"
 #include "virerror.h"
 #include "virxml.h"
 #include "viruuid.h"
@@ -38,7 +39,7 @@
 VIR_LOG_INIT("conf.secret_conf");
 
 VIR_ENUM_IMPL(virSecretUsage, VIR_SECRET_USAGE_TYPE_LAST,
-              "none", "volume", "ceph", "iscsi")
+              "none", "volume", "ceph", "iscsi", "key")
 
 const char *
 virSecretUsageIDForDef(virSecretDefPtr def)
@@ -56,6 +57,9 @@ virSecretUsageIDForDef(virSecretDefPtr def)
     case VIR_SECRET_USAGE_TYPE_ISCSI:
         return def->usage.target;
 
+    case VIR_SECRET_USAGE_TYPE_KEY:
+        return def->usage.key;
+
     default:
         return NULL;
     }
@@ -85,6 +89,10 @@ virSecretDefFree(virSecretDefPtr def)
         VIR_FREE(def->usage.target);
         break;
 
+    case VIR_SECRET_USAGE_TYPE_KEY:
+        VIR_FREE(def->usage.key);
+        break;
+
     default:
         VIR_ERROR(_("unexpected secret usage type %d"), def->usage_type);
         break;
@@ -92,6 +100,7 @@ virSecretDefFree(virSecretDefPtr def)
     VIR_FREE(def);
 }
 
+
 static int
 virSecretDefParseUsage(xmlXPathContextPtr ctxt,
                        virSecretDefPtr def)
@@ -145,6 +154,14 @@ virSecretDefParseUsage(xmlXPathContextPtr ctxt,
         }
         break;
 
+    case VIR_SECRET_USAGE_TYPE_KEY:
+        if (!(def->usage.key = virXPathString("string(./usage/key)", ctxt))) {
+            virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                           _("key usage specified, but key is missing"));
+            return -1;
+        }
+        break;
+
     default:
         virReportError(VIR_ERR_INTERNAL_ERROR,
                        _("unexpected secret usage type %d"),
@@ -305,6 +322,13 @@ virSecretDefFormatUsage(virBufferPtr buf,
         }
         break;
 
+    case VIR_SECRET_USAGE_TYPE_KEY:
+        if (def->usage.key != NULL) {
+            virBufferEscapeString(buf, "<key>%s</key>\n",
+                                  def->usage.key);
+        }
+        break;
+
     default:
         virReportError(VIR_ERR_INTERNAL_ERROR,
                        _("unexpected secret usage type %d"),
diff --git a/src/conf/secret_conf.h b/src/conf/secret_conf.h
index 4584403..352c57e 100644
--- a/src/conf/secret_conf.h
+++ b/src/conf/secret_conf.h
@@ -40,6 +40,7 @@ struct _virSecretDef {
         char *volume;               /* May be NULL */
         char *ceph;
         char *target;
+        char *key;
     } usage;
 };
 
diff --git a/src/conf/virsecretobj.c b/src/conf/virsecretobj.c
index c46d22c..84a32b1 100644
--- a/src/conf/virsecretobj.c
+++ b/src/conf/virsecretobj.c
@@ -237,6 +237,11 @@ virSecretObjSearchName(const void *payload,
         if (STREQ(secret->def->usage.target, data->usageID))
             found = 1;
         break;
+
+    case VIR_SECRET_USAGE_TYPE_KEY:
+        if (STREQ(secret->def->usage.key, data->usageID))
+            found = 1;
+        break;
     }
 
  cleanup:
diff --git a/tests/secretxml2xmlin/usage-key.xml b/tests/secretxml2xmlin/usage-key.xml
new file mode 100644
index 0000000..4b3afd5
--- /dev/null
+++ b/tests/secretxml2xmlin/usage-key.xml
@@ -0,0 +1,7 @@
+<secret ephemeral='no' private='no'>
+  <uuid>f52a81b2-424e-490c-823d-6bd4235bc572</uuid>
+  <description>Sample Key Secret</description>
+  <usage type='key'>
+    <key>mumblyfratz</key>
+  </usage>
+</secret>
diff --git a/tests/secretxml2xmltest.c b/tests/secretxml2xmltest.c
index 8dcbb40..018fa7f 100644
--- a/tests/secretxml2xmltest.c
+++ b/tests/secretxml2xmltest.c
@@ -80,6 +80,7 @@ mymain(void)
     DO_TEST("usage-volume");
     DO_TEST("usage-ceph");
     DO_TEST("usage-iscsi");
+    DO_TEST("usage-key");
 
     return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
 }
-- 
2.5.5

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list



[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]