Volumes aren't zeroed out

[Jesse Andrews]

In LVM implementation, users can potentially access data from other users after volumes are destroyed.

Steps to reproduce:

1) Setup a new install of Nova with Volumes
2) Run a single nova-volume worker using a single 1G volume group
3) Project A:
  * create an instance
  * create a 1G volume
  * attach to instance
  * format & mount volume to /dev/vdb
  * put content onto volume
  * unmount volume
  * detach volume
  * destroy volume
4) Project B:
  * create an instance
  * create 1 1G volume
  * attach to instance at /dev/vdb
  * dd if=/dev/vdb of=/root/data

Expected: project B has a file full of zeros
Actual: project B has a file with information from project A

-----

Simplified Nova is doing the following:

# create a volume group against a file
truncate -s 1G volumes
DEV=`sudo losetup -f --show volumes`
sudo vgcreate nova-volumes $DEV

# manually zero out nova-volumes
lvcreate --size 1000M --name snap nova-volumes
dd if=/dev/zero of=/dev/mapper/nova--volumes-snap
od /dev/mapper/nova--volumes-snap

# verify everything is still zeros
lvremove nova-volumes
lvcreate --size 1000M --name snap nova-volumes
od /dev/mapper/nova--volumes-snap

# put some randomness in
dd if=/dev/urandom of=/dev/mapper/nova--volumes-snap bs=1024 count=1024
lvremove nova-volumes

# and you can still see the randomness
lvcreate --size 1000M --name snap nova-volumes
od /dev/mapper/nova--volumes-snap

[Thierry Carrez (ttx)]

@Jesse: do you have someone working on this ? Would be good to fix before Cactus release...

[Jesse Andrews (anotherjesse)]

working on it

[Jesse Andrews (anotherjesse)]

Adding zeroing out on deletion.

could have done it on creation, but it would be slower for create-volume command