NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

docs: Update docs to reflect LUKS secret changes

Browse Source 
Commit id's 'c8438010', '9bbf0d7e', and '2552fec24' altered the documentation
to describe adding a 'passphrase' type secret usage model in order to reference
the secret for a luks volume. After commit, it was deemed that a 'volume'
usage model should be used, so adjust the various documents in order rephrase
descriptions in order to follow the correct usage model.

Signed-off-by: John Ferlan <jferlan@redhat.com>
This commit is contained in:
John Ferlan
2016-07-11 06:59:03 -04:00
parent a8d0afc75a
commit a6bab5c343
3 changed files with 66 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
docs/formatstorageencryption.html.in
View File

@@ -27,9 +27,9 @@
<code>secret</code> tags, each with mandatory attributes <code>type</code>
and either <code>uuid</code> or <code>usage</code>
(<span class="since">since 2.1.0</span>). The only currently defined
value of <code>type</code> is <code>passphrase</code>. The
value of <code>type</code> is <code>volume</code>. The
<code>uuid</code> is "uuid" of the <code>secret</code> while
<code>usage</code> is the value "usage" subelement field.
<code>usage</code> is the "usage" subelement field.
A secret value can be set in libvirt by the
<a href="html/libvirt-libvirt-secret.html#virSecretSetValue">
<code>virSecretSetValue</code></a> API. Alternatively, if supported
@@ -40,7 +40,7 @@
<h3><a name="StorageEncryptionDefault">"default" format</a></h3>
<p>
<code>&lt;encryption format="default"/&gt;</code> can be specified only
when creating a volume. If the volume is successfully created, the
when creating a qcow volume. If the volume is successfully created, the
encryption formats, parameters and secrets will be auto-generated by
libvirt and the attached <code>encryption</code> tag will be updated.
The unmodified contents of the <code>encryption</code> tag can be used
@@ -59,13 +59,9 @@
<h3><a name="StorageEncryptionLuks">"luks" format</a></h3>
<p>
The <code>luks</code> format is specific to a luks encrypted volume
and the secret used in order to either encrypt or decrypt the volume.
A single <code>&lt;secret type='passphrase'...&gt;</code> element is
expected. The secret may be referenced via either a <code>uuid</code> or
<code>usage</code> attribute. One of the two must be present. When
present for volume creation, the secret will be used in order for
volume encryption. When present for domain usage, the secret will
be used as the passphrase to decrypt the volume.
and the secret is used in order to either encrypt during volume creation
or decrypt the volume for usage by the domain. A single
<code>&lt;secret type='passphrase'...&gt;</code> element is expected.
<span class="since">Since 2.1.0</span>.
</p>
<p>
@@ -135,22 +131,21 @@
&lt;/encryption&gt;</pre>
<p>
Assuming a <a href="formatsecret.html#luksUsageType">
<code>luks secret</code></a> is already defined using a
<code>usage</code> element with an <code>name</code> of "luks_example",
Assuming a <a href="formatsecret.html#VolumeUsageType">
<code>luks volume type secret</code></a> is already defined,
a simple example specifying use of the <code>luks</code> format
for either volume creation without a specific cipher being defined or
as part of a domain volume definition:
</p>
<pre>
&lt;encryption format='luks'&gt;
&lt;secret type='passphrase' usage='luks_example'/&gt;
&lt;secret type='passphrase' uuid='f52a81b2-424e-490c-823d-6bd4235bc572'/&gt;
&lt;/encryption&gt;
</pre>
<p>
Here is an example, specifying use of the <code>luks</code> format for
a specific cipher algorihm for volume creation:
Here is an example specifying use of the <code>luks</code> format for
a specific cipher algorithm for volume creation:
</p>
<pre>
&lt;volume&gt;
@@ -160,7 +155,7 @@
&lt;path&gt;/var/lib/libvirt/images/demo.luks&lt;/path&gt;
&lt;format type='luks'/&gt;
&lt;encryption format='luks'&gt;
&lt;secret type='passphrase' usage='luks_example'/&gt;
&lt;secret type='passphrase' uuid='f52a81b2-424e-490c-823d-6bd4235bc572'/&gt;
&lt;cipher name='twofish' size='256' mode='cbc' hash='sha256'/&gt;
&lt;ivgen name='plain64' hash='sha256'/&gt;
&lt;/encryption&gt;