cdh: store ephemeral LUKS headers in tmpfs #1313
Open
+312
−66
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
manuelh-dev
force-pushed
the
mahuber/luks-temp-header
branch
4 times, most recently
from
eca6522 to
3826f17
Compare
When creating ephemeral storages, place the LUKS headers in guest memory rather than onto the storage device itself. For this, create LUKS header files in the CDH storage directory, and call into CryptInit::init_with_data_device instead of into CryptInit::init. The path where existing, encrypted storages are utilized remains untouched. Signed-off-by: Manuel Huber <[email protected]>
Make sure the unit tests for CDH's luks2 storage driver are executed. Signed-off-by: Manuel Huber <[email protected]>
The test case encrypt_an_empty_device_and_make_a_filesystem_on_it_using_luks2 should be gated behind the luks2 feature. Signed-off-by: Manuel Huber <[email protected]>
manuelh-dev
force-pushed
the
mahuber/luks-temp-header
branch
from
3826f17 to
f2ce4fb
Compare
manuelh-dev
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Outline:
When creating ephemeral storages, place the LUKS headers in guest memory rather than onto the storage device itself. For this, create LUKS header files in the CDH storage directory, and call into
CryptInit::init_with_data_deviceinstead of intoCryptInit::init. This aims to mitigate Vulnerabilities in LUKS2 disk encryption for confidential VMs for ephemeral storages.The path where existing, encrypted storages are utilized remains untouched. We should evaluate switch to utilizing different encryption schemes, such as using ZFS, or VeraCrypt, instead.
Testing:
I tested this end-to-end flow against kata-containers for which I created this draft PR for integration of the new CDH bits: kata-containers/kata-containers#12459
In my tests, I was using the trusted image store functionality in combination with the
kata-qemu-gpu-snphandler.I have also onboarded the luks2 tests to CI, and CI tests pass.
Outlook:
The ongoing work stream to support ephemeral container storage in Kata Containers should benefit from this PR and from the integration branch as well once the guest components are updated in Kata Containers.
Output:
In the guest:
4c 55 4b 53= LUKS magicba be 00 02= LUKS2sha256 appears in the header metadata
On the host:
69 6e 74 65 67 72 74 00is the dm-integrity magic, which is ASCII integrt\0.Log from CDH: