Skip to content

Commit a99a802

Browse files
Pádraig Bradyttx
Pádraig Brady
authored andcommitted
Don't leak info from libvirt LVM backed instances
* nova/virt/libvirt/utils.py (remove_logical_volumes): Overwrite each logical volume with zero (clear_logical_volume): LV obfuscation implementation. (logical_volume_size): A utility function used by clear_logical_volume() Fixes bug: 1070539 Change-Id: I4e1024de8dfe9b0be3b0d6437c836d2042862f85
1 parent 670b388 commit a99a802

File tree

1 file changed

+44
-0
lines changed

1 file changed

+44
-0
lines changed

Diff for: nova/virt/libvirt/utils.py

+44
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,52 @@ def list_logical_volumes(vg):
149149
return [line.strip() for line in out.splitlines()]
150150

151151

152+
def logical_volume_size(path):
153+
"""Get logical volume size in bytes.
154+
155+
:param path: logical volume path
156+
"""
157+
# TODO(p-draigbrady) POssibly replace with the more general
158+
# use of blockdev --getsize64 in future
159+
out, _err = execute('lvs', '-o', 'lv_size', '--noheadings', '--units',
160+
'b', '--nosuffix', path, run_as_root=True)
161+
162+
return int(out)
163+
164+
165+
def clear_logical_volume(path):
166+
"""Obfuscate the logical volume.
167+
168+
:param path: logical volume path
169+
"""
170+
# TODO(p-draigbrady): We currently overwrite with zeros
171+
# but we may want to make this configurable in future
172+
# for more or less security conscious setups.
173+
174+
vol_size = logical_volume_size(path)
175+
bs = 1024 * 1024
176+
remaining_bytes = vol_size
177+
178+
# The loop caters for versions of dd that
179+
# don't support the iflag=count_bytes option.
180+
while remaining_bytes:
181+
zero_blocks = remaining_bytes / bs
182+
seek_blocks = (vol_size - remaining_bytes) / bs
183+
zero_cmd = ('dd', 'bs=%s' % bs,
184+
'if=/dev/zero', 'of=%s' % path,
185+
'seek=%s' % seek_blocks, 'count=%s' % zero_blocks)
186+
if zero_blocks:
187+
utils.execute(*zero_cmd, run_as_root=True)
188+
remaining_bytes %= bs
189+
bs /= 1024 # Limit to 3 iterations
190+
191+
152192
def remove_logical_volumes(*paths):
153193
"""Remove one or more logical volume."""
194+
195+
for path in paths:
196+
clear_logical_volume(path)
197+
154198
if paths:
155199
lvremove = ('lvremove', '-f') + paths
156200
execute(*lvremove, attempts=3, run_as_root=True)

0 commit comments

Comments
 (0)