1

I would like to use the volume encryption mechanism of libvirt. However, I was unable to find information about how to use this feature when running virt-install.

How do I pass the related options?

Edit 1

Based on the answer by Cole Robinson, I tried the following:

virsh --connect qemu:///system secret-define /tmp/testSecret.xml

MYSECRET=`printf %s "blablablaOpen" | base64`

virsh --connect qemu:///system secret-set-value f52a81b2-424e-490c-823d-6bd4235bc572 $MYSECRET

virsh --connect qemu:///system vol-create vm_images /tmp/testLuks.xml

virt-install --disk source_pool=vm_images,source_volume=MyLuks.img --connect qemu:///system -n luksTest -r 2048 --os-type=linux --os-variant debian10 --vnc --location ftp://ftp2.de.debian.org/debian/dists/buster/main/installer-amd64

with testSecret.xml:

<secret ephemeral='no' private='yes'>
   <description>Secret to protect File System</description>
   <uuid>f52a81b2-424e-490c-823d-6bd4235bc572</uuid>
   <usage type='volume'>
      <volume>/opt/vm_images/MyLuks.img</volume>
   </usage>
</secret>

and testLuks.xml:

<volume>
  <name>MyLuks.img</name>
  <capacity unit="G">5</capacity>
  <target>
    <path>/opt/vm_images/MyLuks.img</path>
    <format type='raw'/>
    <encryption format='luks'>
      <secret type='passphrase' uuid='f52a81b2-424e-490c-823d-6bd4235bc572'/>
    </encryption>
  </target>
</volume>

However, I get an error:

ERROR    internal error: process exited while connecting to monitor: 2019-10-15T05:29:57.582967Z qemu-system-x86_64: -drive file=/opt/vm_images/MyLuks.img,format=raw,if=none,id=drive-virtio-disk0: Could not open '/opt/vm_images/MyLuks.img': Permission denied

I assume that this is caused because virt-install does not support encrypted file systems.

Thus I restate my question:

How do I arrive at a bootable virtual machine (e.g. Debian) inside an encrypted container?

One idea might be to clone a system into an encrypted container.

0

virt-install doesn't support creating it natively. you will need to create the volume using libvirt directly (virsh vol-create or similar). Also virt-install doesn't yet support the <disk><encryption> XML either. You might be able to get libvirt to do the right thing with:

virt-install --disk source.pool=POOLNAME,source.volume=VOLNAME

But I haven't tried it myself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.