openstack/security-doc
Code Issues Proposed changes

Remove LVM "shred" volume_clear option

Browse Source 
The shred option was deprecated in Newton and has been removed. This
updates the volume wiping instructions to reflect that change and
corrects a few of the referenced URLs.

Change-Id: I251a07525bec5f099220d41fafb1fce3d738e3cb
This commit is contained in:
Sean McGinnis 2018-02-05 09:52:50 -06:00 committed by Sean McGinnis
parent 246e1b8074
commit 04d5971b3b
1 changed files with 17 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
security-guide/source/block-storage/volume_wiping.rst
View File

@ -4,10 +4,11 @@ Volume Wiping
There are several ways to wipe a block storage device. The traditional way is
to set the ``lvm_type`` to ``thin``, and then use the ``volume_clear``
parameter. Alternatively, if the volume encryption feature is used, then
volume wiping is not necessary if the volume encryption key is deleted.
See the OpenStack Configuration Reference doc in the `Volume Encryption
<https://docs.openstack.org/ocata/config-reference/block-storage/volume-encryption.html>`__
parameter if using the LVM backend. Alternatively, if the volume encryption
feature is used, then volume wiping is not necessary if the volume encryption
key is deleted. See the OpenStack Configuration Reference doc in the
`Volume Encryption
<https://docs.openstack.org/cinder/latest/configuration/block-storage/volume-encryption.html>`__
section for set up details and also the `Castellan usage
<https://docs.openstack.org/castellan/latest/user/index.html>`__ document
for key deletion.
@ -18,21 +19,17 @@ for key deletion.
wipe. While this method still works, ``lvm_type=default`` is not
recommended for setting secure delete.
The ``volume_clear`` parameter can accept either ``zero`` or ``shred``
arguments. The ``zero`` argument will write a single pass of zeroes to the
device. The ``shred`` argument will write three passes of predetermined bit
patterns.
The ``volume_clear`` parameter can be set to ``zero``. The ``zero`` argument
will write a single pass of zeroes to the device.
For more information about the ``lvm_type`` parameter, see
the `LVM Block Storage section
<https://docs.openstack.org/ocata/config-reference/block-storage/drivers/lvm-volume-driver.html>`__
For more information about the ``lvm_type`` parameter, see sections
`LVM
<https://docs.openstack.org/cinder/latest/configuration/block-storage/drivers/lvm-volume-driver.html>`__
and `Oversubscription in thin provisioning
<https://docs.openstack.org/cinder/latest/admin/blockstorage-over-subscription.html>`__
of the *cinder* project documentation.
of OpenStack Configuration Reference and
the `Oversubscription in thin provisioning
<https://docs.openstack.org/admin-guide/blockstorage_over_subscription.html>`__
of OpenStack Administrator Guide.
For more information about the ``volume_clear`` parameter, see the
`Block Storage sample configuration files
<https://docs.openstack.org/ocata/config-reference/block-storage/samples/index.html>`__
of OpenStack Configuration Reference.
For more information about the ``volume_clear`` parameter, see section
`Cinder Configuration Options
<https://docs.openstack.org/cinder/latest/sample_config.html>`__
of the *cinder* project documentation.