ClusterLabs/pacemaker — pull request #244 by gao-yan (2013-03-06 06:46:14+00:00)
Title: Feature: lrmd: Support CIB secrets - allow storing parameters in local files (lf#2415, cl#5121, bnc#792140)

Sensitive information contained in the CIB can be moved to local files.
The CIB values are replaced by a magic string "lrm://" to signal lrmd
that it should lookup the content elsewhere.

An MD5 hash is stored in local file, by appending ".sign" extension.
lrmd checks if the hash matches the value in local files. If there is a
mismatch, the operation fails. stop operations are exceptions and they
proceed regardless (for stonith resources stop happens in stonithd and
for and for other resource it is very probable that passwords don't
influence stop).

Local files are stored in:
/var/lib/pacemaker/lrm/secrets//

Reading from the legacy location is still possible for compatibility:
/var/lib/heartbeat/lrm/secrets//

and files contain just a value, there's not format. The values may not
span multiple lines and whitespace at the right is stripped.

cibsecret is a program which handles user interface. It is not necessary
to use any other tools to manage the local files storage. Users don't
need to know about how and where the files are stored.