Re: [debops-users] Using libvirt without sudo rights
I was able to fix my issue without a Polkit rule. Simply add my users to
`libvirt` group in place of `libvirtd` group did the trick.
I found the root cause.
I previously did an installation of libvirt by hand on this host. During
my installation, I created a group called "libvirtd".
After, I started to manage this server with DebOps without removing this
old group. This morning, I noticed that my gitlab-runner and
`libvirtd__admins` are members of `libvirtd` group in place of `libvirt`
group (without a 'd' at end)
My ansible_local facts:
#v+
"libvirtd": {
"deployment_mode": "libvirt",
"hw_virt": true,
"installed": true,
"unix_sock_group": "libvirtd"
#v-
`libvirtd.fact` on host contains:
#v+
for group in unix_groups:
if group.gr_name == 'libvirt':
output['unix_sock_group'] = 'libvirt'
elif group.gr_name == 'libvirtd':
output['unix_sock_group'] = 'libvirtd'
#v-
This mean that `libvirtd` group will always take precedence over
`libvirt` group if both are present. I'm not sure this is an expected
behavior.
However, if you are member of `libvirtd` in place of `libvirt`, virsh
fallback to Polkit authentication according to
/usr/share/doc/libvirt-daemon/README.Debian.gz:
Access Control
==============
Access to the libvirt managing tasks is controlled by PolicyKit. To ease
configuration membership in the "libvirt" group is sufficient. If you want to
manage VMs as non-root you need to add a user to that group.
--
Nicolas Quiniou-Briand
Jabber/XMPP : nqb(a)azyx.fr