MAAS should use secure disk erase, when possible

[Dustin Kirkland ]

Recently, MAAS added a feature to securely wipe disks in between provisioning runs, to secure user data from one machine usage to another. This was, roughly speaking, the feature request in Bug #1308194.

The current implementation actually rewrites all of the data using either dd or shred (I'm not sure which, honestly).

In any case, it's incredibly slow, especially on very large hard drives.

Many new drives, especially SSDs, have a feature colloquially known as "Secure Disk Erase". In short, all data is encrypted on the drive itself by the disk controller with a key that never leaves the firmware of the device. That key can be erased (or, in fact, rekeyed) very efficiently, and render all of the data on the device unreadable, more efficiently than dd or shred.

For more information, see:

https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase

MAAS should, opportunistically, use this erase procedure whenever possible.

Cheers,
Dustin

[Dustin Kirkland  (kirkland)]

All the magic is in hdparm!

[Christian Reis (kiko)]

See also bug 1507745