file based disk images do not get scrubbed on delete

[Alan Meadows]

Right now, LVM backed instances can be scrubbed (overwritten with zeros using dd) upon deletion. However, there is no such option with file backed images. While it is true that fallocate can handle some of this by returning 0s to the instance when reading any unwritten parts of the file, there are some cases where it is not desirable to enable fallocate.

What would be preferred would be a similar the options cinder has implemented, so the operator can choose to shred or zero out the file, based on their organizations own internal data policies. A zero out option satisfies those that must ensure they scrub tenant data upon deletion, and shred would satisfy those beholden to DoD 5220-22.

This would of course make file backed disks vulnerable to https://bugs.launchpad.net/nova/+bug/889299 but that might not be a bad thing considering its quite old.

Attached an initial patch for nova/virt/libvirt/driver.py that performs the same LVM zero scrub routine to disk backed files, however it lacks any flags to enable or disable it right now.

[Michael Still (mikal)]

Thanks for the patch Pentheus. We use an online code review process for review patches. Could you please follow the steps at https://wiki.openstack.org/wiki/How_To_Contribute#If_you.27re_a_developer to register and then propose your patch? Thanks!

[Sean Dague (sdague)]

So, honestly, I think the scrub approach is too error prone, because it requires an active thing later to get rid of the data. However, the encrypted disk work that's been coming in, especially if there is a per instance generated key, means the data is useless if someone goes and physically removes the server from the cluster. So my $0.02 would be focus on the encrypted data path instead.

[Max Lobur (max-lobur)]

I would like to raise this up again. We have a willingness to commit this functionality upstream. Anybody still thinks this would be useful?

An option called
wipe_vm_disk_with_zeros_before_delete=True
and corresponding change in libvirt driver for file-backed images.

[Sean Dague (sdague)]

Marking as Opinion because the solution here really needs to be encryption at rest so that a crashed nova compute doesn't leave customer data out there.

[Markus Zoeller (markus_z) (mzoeller)]

Closed as "Opinion" in comment #5 and wrongly re-opened by follow up updates of this bug report.