30

When starting virt-manager, it asks for the root password.

It looks like virt-manager causes the libvirtd daemon to run pkcheck with a couple of arguments, which then shows this authentication dialog. So it's PolicyKit who's asking for the root password.

The official website (libvirt.org) describes how to define a PolicyKit rule to get rid of the password prompt:

$ sudo cat /etc/polkit-1/localauthority/50-local.d/50-org.example-libvirt-remote-access.pkla
[libvirt Management Access]
Identity=unix-group:libvirt
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes

The subdirectory "localauthority" did not exist. Creating it and putting a file with that name and content (libvirt -> my group name) in there does not seem to have any effect. Also, there's a default file, which uses JavaScript syntax:

/etc/polkit-1/rules.d/50-default.rules

This package is installed on the system, plus a few DE frontends:

polkit-0.107-4.fc18.x86_64

Apparently the example configuration on libvirt.org is outdated?

What configuration is necessary to get rid of the password prompt (for a specific user group)?

4 Answers 4

22
+50

/etc/polkit-1/rules.d/10.virt.rules:

polkit.addRule(function(action, subject) {
    if (action.id == "org.libvirt.unix.manage"
            && subject.local
            && subject.active
            && subject.isInGroup("libvirt")) {
        return polkit.Result.YES;
    }
});

You'll have to perform common steps including restarting policykit and starting a new session with the respective user after adding him to the libvirt group.

It looks like the resource is about Fedora 18 but it uses the javascript syntax already so it's most probably valid for Fedora 19 as well.

Links:

5
  • 1
    This solution works! Thanks for the links as well. Bounty awarded.
    – senorsmile
    Oct 15, 2013 at 21:43
  • Sorry for the wrong formatting, fixed that. Oct 16, 2013 at 7:05
  • 1
    How does this compare to adding the user to the libvirt group? I tested adding the user to the libvirt group and then the additional authentication wasn't required.
    – Baldrick
    Mar 2, 2017 at 18:16
  • 2
    @jwbensley The polkit way is dynamic and gives the permissions to the owner of the active local session. The group way is static and gives the privilege to that specific user. Choose your ways as you see fit. Mar 7, 2017 at 18:18
  • Worked like a charm also the rolling Archlinux (sept 2022)! Sep 18, 2022 at 7:56
11

I found that simply adding my user to libvirt and kvm groups stopped the prompts.

sudo usermod -a -G libvirt $(whoami)
sudo usermod -a -G kvm $(whoami)

whoami outputs your username that way it will get replaced by your username automatically

1
2

The password prompt was made for system security so if you do this might make it vulnerable.

  1. Create the Group group on your machine. or you can run this "sudo groupadd -r Group"

  2. You can any user you want to this system group by runing "sudo usermod -a -G Group User"

  3. Now you need to create our PolicyKit policy that will allow the users of Group to run virt-manager

you will create a file at this path:"/etc/polkit-1/localauthority/50-local.d/50-org.Group-libvirt-local-access.pkla"
and you will put lines below in it

[Allow group Group libvirt management permissions]
Identity=unix-group:Group
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Thats all you needed to do now you can run it. And i hope this helps you.

4
  • 1
    This is the old solution. This solution does NOT work on newer systemd based Linux operating systems, such as Fedora 19 or Current Arch. (I just tested it. There is not even a localauthority directory, and creating, the subfolder and the specified file do nothing).
    – senorsmile
    Oct 15, 2013 at 14:51
  • @senorsmile Did you file a bug report with Fedora 19? Oct 15, 2013 at 17:27
  • this solution actually works under debian buster Nov 1, 2020 at 10:56
  • Why would it be vulnerable? Just using sudo usermod -a -G libvirt $USER like mentioned in discussion.fedoraproject.org/t/… worked for me and does not look vulnerable.
    – baptx
    Mar 4 at 0:22
0

I would actually use

sudo usermod -a -G libvirt $(whoami)
sudo usermod -a -G kvm $(whoami)

That way just copy pasting would work directly since whoami outputs your username

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .