5:27 a.m.
On Thu, Dec 12, 2024 at 03:10:15PM +0400, Denys Ostapenko wrote:
>>I found it's surprisingly hard to access VeraCrypt
partition inside
>>VHD file.
>
>I'm not sure what VeraCrypt is, but I don't think we have support for
>it in libguestfs, which is going to be a problem. Unless kernel /
>cryptsetup knows about it somehow.
VeraCrypt is a TrueCrypt fork (disk-encryption software),
open-source and cross-platform.
>On Thu, Dec 12, 2024 at 02:45:48AM +0400, Denys Ostapenko wrote:
>>Is it possible to expose raw partition from libguestfs (and
>>guestfish) as a mapper device? Like cryptsetup-open <partition>
>><mapper>, but without password and decryption at all.
>
>I'm not sure what you mean by this. Do you mean, expose the encrypted
>device as a block device on the host? (ie. guestmount)
I have file.vhd and /dev/sda1 partition (VeraCrypt encrypted)
inside. This partition is raw; guestfish can not recognize it,
because without password VeraCrypt partition is indistinguishable
from random. In Windows, out-of-the-box VHD mount tool creates
device like \Device\Harddisk2\Partition1, so I can mount it in
VeraCrypt. I have not found a way to ask guestfish/libguestfs to
expose such raw partition from inside VHD as host block device.
Doesn't doing this work?
$ guestmount [--ro] -a guest.img -m /dev/sda1 /var/tmp/some_mountpoint
It's not a host block device, but near enough. It'll also be quite
slow because it's using FUSE.
If VeraCrypt can be taught how to access an NBD endpoint instead of
needing POSIX APIs, then you could do something with qemu-nbd &
nbdkit, although it's a little clunky because of the nested partition
and because qemu-nbd removed support for the '-P' option.
It could look like:
guestfs_loopback_partition(g, "/dev/sda1", "file-vhd-sda1-mapper");
// Creates /dev/mapper/file-vhd-sda1-mapper
or even
guestfs_loopback_disk(g, "file-vhd-mapper");
instead of
guestfs_mount(g, "/dev/sda1", "/media/file-vhd-sda1");
VeraCrypt on Linux by itself creates /dev/mapper/veracrypt1
decrypted block device from encrypted partition or file, and does
not depend on filesystem inside. I wonder if there is similar
approach in libguestfs to not depend on
encryption/filesystem/filesystem integrity inside a virtual disk
partition. Also, dmsetup allows to create a single block device from
a few ranges of bytes of device or file, encrypted or not.
I think the best idea is probably to add VeraCrypt support to
libguestfs, but that's some work that I don't have time for that myself.
My current workaround is to expose partition from non-fragmented VHD
file (which is dd copy of disk with 512-byte footer) to block device
by losetup/dmsetup, and then mount it by VeraCrypt. Fragmented VHDs
are not working this way.
Rich.
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html
5:31 a.m.
New subject: Expose raw partition by libguestfs?
On Thu, Dec 12, 2024 at 11:27:35AM +0000, Richard W.M. Jones wrote:
On Thu, Dec 12, 2024 at 03:10:15PM +0400, Denys Ostapenko wrote:
> >>I found it's surprisingly hard to access VeraCrypt partition inside
> >>VHD file.
> >
> >I'm not sure what VeraCrypt is, but I don't think we have support for
> >it in libguestfs, which is going to be a problem. Unless kernel /
> >cryptsetup knows about it somehow.
>
> VeraCrypt is a TrueCrypt fork (disk-encryption software),
> open-source and cross-platform.
>
> >On Thu, Dec 12, 2024 at 02:45:48AM +0400, Denys Ostapenko wrote:
> >>Is it possible to expose raw partition from libguestfs (and
> >>guestfish) as a mapper device? Like cryptsetup-open <partition>
> >><mapper>, but without password and decryption at all.
> >
> >I'm not sure what you mean by this. Do you mean, expose the encrypted
> >device as a block device on the host? (ie. guestmount)
>
> I have file.vhd and /dev/sda1 partition (VeraCrypt encrypted)
> inside. This partition is raw; guestfish can not recognize it,
> because without password VeraCrypt partition is indistinguishable
> from random. In Windows, out-of-the-box VHD mount tool creates
> device like \Device\Harddisk2\Partition1, so I can mount it in
> VeraCrypt. I have not found a way to ask guestfish/libguestfs to
> expose such raw partition from inside VHD as host block device.
Doesn't doing this work?
$ guestmount [--ro] -a guest.img -m /dev/sda1 /var/tmp/some_mountpoint
It's not a host block device, but near enough. It'll also be quite
slow because it's using FUSE.
If VeraCrypt can be taught how to access an NBD endpoint instead of
needing POSIX APIs, then you could do something with qemu-nbd &
nbdkit, although it's a little clunky because of the nested partition
and because qemu-nbd removed support for the '-P' option.
Can you just combine qemu-nbd with kpartx to setup devmapper
nodes for each partition:
qemu-nbd -c /dev/nbd0 guest.img
kpartx -a /dev/nbd0
will give you /dev/mapper/nbd0p1 which you can then access
with whatever you need for VeraCrypt on a host blockdev
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
6:09 a.m.
New subject: Expose raw partition by libguestfs?
On Thu, Dec 12, 2024 at 11:31:43AM +0000, Daniel P. Berrangé wrote:
On Thu, Dec 12, 2024 at 11:27:35AM +0000, Richard W.M. Jones wrote:
> On Thu, Dec 12, 2024 at 03:10:15PM +0400, Denys Ostapenko wrote:
> > >>I found it's surprisingly hard to access VeraCrypt partition
inside
> > >>VHD file.
> > >
> > >I'm not sure what VeraCrypt is, but I don't think we have support
for
> > >it in libguestfs, which is going to be a problem. Unless kernel /
> > >cryptsetup knows about it somehow.
> >
> > VeraCrypt is a TrueCrypt fork (disk-encryption software),
> > open-source and cross-platform.
> >
> > >On Thu, Dec 12, 2024 at 02:45:48AM +0400, Denys Ostapenko wrote:
> > >>Is it possible to expose raw partition from libguestfs (and
> > >>guestfish) as a mapper device? Like cryptsetup-open <partition>
> > >><mapper>, but without password and decryption at all.
> > >
> > >I'm not sure what you mean by this. Do you mean, expose the encrypted
> > >device as a block device on the host? (ie. guestmount)
> >
> > I have file.vhd and /dev/sda1 partition (VeraCrypt encrypted)
> > inside. This partition is raw; guestfish can not recognize it,
> > because without password VeraCrypt partition is indistinguishable
> > from random. In Windows, out-of-the-box VHD mount tool creates
> > device like \Device\Harddisk2\Partition1, so I can mount it in
> > VeraCrypt. I have not found a way to ask guestfish/libguestfs to
> > expose such raw partition from inside VHD as host block device.
>
> Doesn't doing this work?
>
> $ guestmount [--ro] -a guest.img -m /dev/sda1 /var/tmp/some_mountpoint
>
> It's not a host block device, but near enough. It'll also be quite
> slow because it's using FUSE.
>
> If VeraCrypt can be taught how to access an NBD endpoint instead of
> needing POSIX APIs, then you could do something with qemu-nbd &
> nbdkit, although it's a little clunky because of the nested partition
> and because qemu-nbd removed support for the '-P' option.
Can you just combine qemu-nbd with kpartx to setup devmapper
nodes for each partition:
qemu-nbd -c /dev/nbd0 guest.img
kpartx -a /dev/nbd0
will give you /dev/mapper/nbd0p1 which you can then access
with whatever you need for VeraCrypt on a host blockdev
I suspected that Denys wanted to do all this as non-root, but
that certainly works for root.
For non-root you can put nbdkit-partition-filter in front of
nbdkit-nbd-plugin in front of qemu-nbd, but it's all starting to get
very clunky at that point (plus you still have to teach VeraCrypt to
use NBD).
Rich.
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html
8:35 a.m.
New subject: Expose raw partition by libguestfs?
2024-12-12 15:31, Daniel P. Berrangé пишет:
On Thu, Dec 12, 2024 at 11:27:35AM +0000, Richard W.M. Jones wrote:
> On Thu, Dec 12, 2024 at 03:10:15PM +0400, Denys Ostapenko wrote:
>>>> I found it's surprisingly hard to access VeraCrypt partition inside
>>>> VHD file.
>>>
>>> I'm not sure what VeraCrypt is, but I don't think we have support
for
>>> it in libguestfs, which is going to be a problem. Unless kernel /
>>> cryptsetup knows about it somehow.
>>
>> VeraCrypt is a TrueCrypt fork (disk-encryption software),
>> open-source and cross-platform.
>>
>>> On Thu, Dec 12, 2024 at 02:45:48AM +0400, Denys Ostapenko wrote:
>>>> Is it possible to expose raw partition from libguestfs (and
>>>> guestfish) as a mapper device? Like cryptsetup-open <partition>
>>>> <mapper>, but without password and decryption at all.
>>>
>>> I'm not sure what you mean by this. Do you mean, expose the encrypted
>>> device as a block device on the host? (ie. guestmount)
>>
>> I have file.vhd and /dev/sda1 partition (VeraCrypt encrypted)
>> inside. This partition is raw; guestfish can not recognize it,
>> because without password VeraCrypt partition is indistinguishable
>> from random. In Windows, out-of-the-box VHD mount tool creates
>> device like \Device\Harddisk2\Partition1, so I can mount it in
>> VeraCrypt. I have not found a way to ask guestfish/libguestfs to
>> expose such raw partition from inside VHD as host block device.
>
> Doesn't doing this work?
>
> $ guestmount [--ro] -a guest.img -m /dev/sda1 /var/tmp/some_mountpoint
>
> It's not a host block device, but near enough. It'll also be quite
> slow because it's using FUSE.
>
> If VeraCrypt can be taught how to access an NBD endpoint instead of
> needing POSIX APIs, then you could do something with qemu-nbd &
> nbdkit, although it's a little clunky because of the nested partition
> and because qemu-nbd removed support for the '-P' option.
Can you just combine qemu-nbd with kpartx to setup devmapper
nodes for each partition:
qemu-nbd -c /dev/nbd0 guest.img
kpartx -a /dev/nbd0
will give you /dev/mapper/nbd0p1 which you can then access
with whatever you need for VeraCrypt on a host blockdev
Thank you very much, qemu-nbd works
sudo apt install nbd-client -y
sudo modprobe nbd
sudo qemu-nbd --read-only --connect=/dev/nbd0 /media/disk/file.vhd
sudo kpartx -a /dev/nbd0
sudo mkdir /media/file-vhd
sudo veracrypt -m=nokernelcrypto /dev/nbd0p1 /media/file-vhd
Option -m=nokernelcrypto is required, without it VeraCrypt outputs
Error: device-mapper: reload ioctl on veracrypt1 failed: Device or
resource busy
Looks like there is already VeraCrypt support in cryptsetup,
--type=tcrypt-veracrypt, is there some way to pass this option through
guestfish?
Is it worth to be added in FAQ?
8:39 a.m.
New subject: Expose raw partition by libguestfs?
On Thu, Dec 12, 2024 at 06:35:16PM +0400, Denys Ostapenko wrote:
Looks like there is already VeraCrypt support in cryptsetup,
--type=tcrypt-veracrypt, is there some way to pass this option
through guestfish?
My reading of the code is that you should just be able to do
(untested):
<fs> cryptsetup-open /dev/sda1 luks crypttype:tcrypt-veracrypt
That won't work if VeraCrypt requires other specialized parameters
beyond the basics like passphrase.
Rich.
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
nbdkit - Flexible, fast NBD server with plugins
https://gitlab.com/nbdkit/nbdkit
8:45 a.m.
New subject: Expose raw partition by libguestfs?
Another thing that would make the experience smoother is to
extend the list of heuristics below here:
https://github.com/libguestfs/libguestfs/blob/master/daemon/cryptsetup.ml...
Rich.
--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines. Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v
11
days inactive
11
days old
3 comments
3 participants
participants (3)
-
Daniel P. Berrangé -
Denys Ostapenko -
Richard W.M. Jones