0

I configure libvirt to use "users" group to run vm's

 grep -w users /etc/libvirt/qemu.conf
# unix socket. This prevents unprivileged access from users on the
# unix socket. This prevents unprivileged access from users on the
group = "users"
# deployments. It is strongly recommended that users update their

I can launch vm's from user without problem,they run.. But ps said..running as root and not as my unprivileged user,why?

ps -ef|grep qemu
root     15248     1 33 14:53 ?        00:01:05 /usr/bin/qemu-kvm -name guest=

Is possible to run the vm as unprivileged user? Distro is slackware 14.2, and of course i'm on users group

0

Solution found.

First on libvirt SlackBuild, add or modify those lines

VIRTGROUP=${VIRTGROUP:-kvm}

./configure \
  --prefix=/usr \
  --libdir=/usr/lib${LIBDIRSUFFIX} \
  --bindir=/usr/sbin \
  --sbindir=/usr/sbin \
  --disable-static \
  --sysconfdir=/etc \
  --localstatedir=/var \
  --mandir=/usr/man \
  --docdir=/usr/doc/$PRGNAM-$VERSION \
  --enable-static=no \
  --enable-shared=yes \
  --with-qemu-group=$VIRTGROUP \
  --with-qemu-user=nobody \
  --without-hal \
  --with-interface \
  --with-lxc \
  --with-udev \
  --with-storage-disk \
  --with-storage-gluster \
  --with-storage-lvm \
  --with-init-script=none

# udev rules
mkdir -p $PKG/etc/udev/rules.d/65-kvm.rules
install -D -m 0644 $CWD/65-kvm.rules $PKG/etc/udev/rules.d/65-kvm.rules

udev rules must be like this

cat /etc/udev/rules.d/65-kvm.rules 
KERNEL=="kvm", NAME="%k", GROUP="kvm", MODE="0660"

Don't forget the polkit part otherwise libvirt run only as root

 cat /usr/share/polkit-1/rules.d/50-libvirt.rules 
// Allow any user in the 'libvirt' group to connect to system libvirtd
// without entering a password.

polkit.addRule(function(action, subject) {
    if (action.id == "org.libvirt.unix.manage" &&
        subject.isInGroup("libvirt")) {
        return polkit.Result.YES;
    }
});

After restart libivirt ps return nobody for qemu user

ps  -o user,group,cmd -p 14123
USER     GROUP    CMD
nobody   kvm      /usr/bin/qemu-kvm -name guest=..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.