Libvirt should expose a way to define a script/executable to gracefully release the locks. Eg:

<?xml version="1.0"?>
<domain type="kvm">
  <devices>
    <leaseFence timeout="X">/path/to/my/fence/script</leaseFence>
    <lease>[...]</lease>
    [...]
  </devices>
</domain>

This has to be done in libvirt because the script must be defined before acquiring the leases for the qemu process.

+++ This bug was initially created as a clone of Bug #826022 +++

Description of problem:
At the moment the only supported way of fencing a process that lost its resources (lockspace unreachable) is killing the pid with SIGTERM/SIGKILL. Looking forward we want support a graceful interaction between sanlock and the monitored process.

Use case:

In oVirt sanlock is used to acquire the volumes (disks) resources for a qemu-kvm process. If the storage domain is unreacheable (lockspace) sanlock is terminating the qemu-kvm process. The graceful way of handling the situation is to interact with the qemu-kvm process (probably a script that connects to libvirt) and pauses the guest.

When the storage is reachable again it's the manager's responsibility (vdsm) to reacquire the lockspace, reacquire the volume resources for the qemu process (checking the lver value to make sure that they haven't changed), and unpause the guest.

The benefit is that during the storage domain down time the VM isn't killed but simply paused.

Possible implementation:
Define a new API to configure a script (per monitored process) to be used for the graceful release of resources.
If the script fails we should escalate to SIGTERM/SIGKILL and ultimately to the dogwatch host fencing.