5

In a debian host with many users, I want to allow different users to create their own VMs, completely independent of each other.

The closest relevant (non-root) way I have seen in guides is by connecting to the qemu:///system hypervisor . This is the system hypervisor which is shared among all users. What is more the disk image file will be owned by root (or kvm) user, meaning that the whole filesystem path to the location of the disk image file must be world readable.

For the above and other reasons I want to run my VMs purely and completely as non root user. That is as qemu:///session . So the main question is how do I do that? Are there any guides I could use?

I went as far as trying to create new virtual bridge iface, but even though I am member of the netdev group I get "permission denied" errors when I do the following:

 virsh -c qemu:///session net-create /etc/libvirt/qemu/networks/mynet.xml

note than mynet.xml is just like default network but at a different subnet.

4

What you're using isn't KVM directly, but a management library called libvirt.

You can specify a user which will have access to libvirt's setup (and thus creating VMs and pretty much running virsh commands) by adding the users to the libvirtd and kvm groups on the host.

You can also use policykit to manage access, the procedure is described in the libvirt Wiki: SSHPolicyKitSetup | Libvirt Wiki

3

For KVM you need access to the device /dev/kvm. If user can read/write to this device, then he can run KVM-based virtual machines without root privileges.

In most distributions members of the kvm group has access to this device, so all you need to do is to add the user to the kvm group.

-3

You cannot. KVM requires ROOT privileges to access low-level hardware threads on your CPU.

How do I know this? Because I have worked with the KVM source code to contribute to the FaiKVM project, The Fully Automatic Install Kernel-Based Virtual Machine project. We modified the source code to support an X64 virtual kernel within a 32-bit user-space. That's the gist of it.

  • 2
    you can use qemu, which uses kvm, as a normal user; without being root. now libvirt imposes a few restrictions on it's api for qemu:///session uris, but using the kvm module doesn't require being root. – llua Oct 3 '14 at 15:58
  • 1
    this isn't qemu, this is pure libvirt. – dyasny Oct 3 '14 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.