]> git.ipfire.org Git - thirdparty/libvirt.git/commit
secret: Add secret.conf configuration file and parse it
authorArun Menon <armenon@redhat.com>
Tue, 10 Feb 2026 17:56:40 +0000 (23:26 +0530)
committerPeter Krempa <pkrempa@redhat.com>
Thu, 12 Feb 2026 16:07:58 +0000 (17:07 +0100)
commit1c86748cf140a8710d6d8ec3ab3a2bd10ceeac67
treed8873bf9ca0dd904cc855be97c8037dc77a27f24
parent97758bc9a0b1fccf8c0009308658f1204b113b89
secret: Add secret.conf configuration file and parse it

A new configuration file called secret.conf is introduced to
let the user configure the path to the secrets encryption key.
This key will be used to encrypt/decrypt the secrets in libvirt.

By default the path is set to the runtime directory
/run/libvirt/secrets, and it is commented in the config file.
After parsing the file, the virtsecretd driver checks if an
encryption key is present in the path and is valid.

If no encryption key is present in the path, then
the service will by default use the encryption key stored in the
CREDENTIALS_DIRECTORY.

Add logic to parse the encryption key file and store the key.
It also checks for the encrypt_data attribute in the config file.
The encryption and decryption logic will be added in the subsequent patches.

Signed-off-by: Arun Menon <armenon@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
include/libvirt/virterror.h
libvirt.spec.in
po/POTFILES
src/secret/libvirt_secrets.aug [new file with mode: 0644]
src/secret/meson.build
src/secret/secret.conf.in [new file with mode: 0644]
src/secret/secret_config.c [new file with mode: 0644]
src/secret/secret_config.h [new file with mode: 0644]
src/secret/secret_driver.c
src/secret/test_libvirt_secrets.aug.in [new file with mode: 0644]
src/util/virerror.c