|
 |
ca2a74 |
From 0b92347337e9201140ed2daf77a934c731de6630 Mon Sep 17 00:00:00 2001
|
|
|
ca2a74 |
From: Laszlo Ersek <lersek@redhat.com>
|
|
|
ca2a74 |
Date: Thu, 14 Jul 2022 12:40:05 +0200
|
|
|
ca2a74 |
Subject: [PATCH] sysprep: advise against cloning VMs with internal full disk
|
|
|
ca2a74 |
encryption
|
|
|
ca2a74 |
|
|
|
ca2a74 |
This is relevant for sysprep because we recommend sysprep for facilitating
|
|
|
ca2a74 |
cloning.
|
|
|
ca2a74 |
|
|
|
ca2a74 |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2106286
|
|
|
ca2a74 |
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
ca2a74 |
Message-Id: <20220714104005.8334-3-lersek@redhat.com>
|
|
|
ca2a74 |
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
|
|
|
ca2a74 |
(cherry picked from commit b49ee909f5d1a0d7b5c668335b9098ca8ff85bfd)
|
|
|
ca2a74 |
---
|
|
|
ca2a74 |
sysprep/virt-sysprep.pod | 7 +++++++
|
|
|
ca2a74 |
1 file changed, 7 insertions(+)
|
|
|
ca2a74 |
|
|
|
ca2a74 |
diff --git a/sysprep/virt-sysprep.pod b/sysprep/virt-sysprep.pod
|
|
|
ca2a74 |
index deeb5341e..232b9f24b 100644
|
|
|
ca2a74 |
--- a/sysprep/virt-sysprep.pod
|
|
|
ca2a74 |
+++ b/sysprep/virt-sysprep.pod
|
|
|
ca2a74 |
@@ -519,6 +519,13 @@ Either or both options can be used multiple times on the command line.
|
|
|
ca2a74 |
|
|
|
ca2a74 |
=head1 SECURITY
|
|
|
ca2a74 |
|
|
|
ca2a74 |
+Virtual machines that employ full disk encryption I
|
|
|
ca2a74 |
+guest> should not be considered for cloning and distribution, as it
|
|
|
ca2a74 |
+provides multiple parties with the same internal volume key, enabling
|
|
|
ca2a74 |
+any one such party to decrypt all the other clones. Refer to the L
|
|
|
ca2a74 |
+FAQ|https://gitlab.com/cryptsetup/cryptsetup/-/blob/main/FAQ.md> for
|
|
|
ca2a74 |
+details.
|
|
|
ca2a74 |
+
|
|
|
ca2a74 |
Although virt-sysprep removes some sensitive information from the
|
|
|
ca2a74 |
guest, it does not pretend to remove all of it. You should examine
|
|
|
ca2a74 |
the L</OPERATIONS> above and the guest afterwards.
|
|
|
ca2a74 |
--
|
|
|
ca2a74 |
2.31.1
|
|
|
ca2a74 |
|