16

When starting virt-manager, it asks for the root password.

It looks like virt-manager causes the libvirtd daemon to run pkcheck with a couple of arguments, which then shows this authentication dialog. So it's PolicyKit who's asking for the root password.

The official website (libvirt.org) describes how to define a PolicyKit rule to get rid of the password prompt:

$ sudo cat /etc/polkit-1/localauthority/50-local.d/50-org.example-libvirt-remote-access.pkla
[libvirt Management Access]
Identity=unix-group:libvirt
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes

The subdirectory "localauthority" did not exist. Creating it and putting a file with that name and content (libvirt -> my group name) in there does not seem to have any effect. Also, there's a default file, which uses JavaScript syntax:

/etc/polkit-1/rules.d/50-default.rules

This package is installed on the system, plus a few DE frontends:

polkit-0.107-4.fc18.x86_64

Apparently the example configuration on libvirt.org is outdated?

What configuration is necessary to get rid of the password prompt (for a specific user group)?

14
+50

/etc/polkit-1/rules.d/10.virt.rules:

polkit.addRule(function(action, subject) {
    if (action.id == "org.libvirt.unix.manage"
            && subject.local
            && subject.active
            && subject.isInGroup("libvirt")) {
        return polkit.Result.YES;
    }
});

You'll have to perform common steps including restarting policykit and starting a new session with the respective user after adding him to the libvirt group.

It looks like the resource is about Fedora 18 but it uses the javascript syntax already so it's most probably valid for Fedora 19 as well.

Links:

  • 1
    This solution works! Thanks for the links as well. Bounty awarded. – senorsmile Oct 15 '13 at 21:43
  • Sorry for the wrong formatting, fixed that. – Pavel Šimerda Oct 16 '13 at 7:05
  • How does this compare to adding the user to the libvirt group? I tested adding the user to the libvirt group and then the additional authentication wasn't required. – jwbensley Mar 2 '17 at 18:16
  • 1
    @jwbensley The polkit way is dynamic and gives the permissions to the owner of the active local session. The group way is static and gives the privilege to that specific user. Choose your ways as you see fit. – Pavel Šimerda Mar 7 '17 at 18:18
1

The password prompt was made for system security so if you do this might make it vulnerable.

  1. Create the Group group on your machine. or you can run this "sudo groupadd -r Group"

  2. You can any user you want to this system group by runing "sudo usermod -a -G Group User"

  3. Now you need to create our PolicyKit policy that will allow the users of Group to run virt-manager

you will create a file at this path:"/etc/polkit-1/localauthority/50-local.d/50-org.Group-libvirt-local-access.pkla"
and you will put lines below in it

[Allow group Group libvirt management permissions]
Identity=unix-group:Group
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Thats all you needed to do now you can run it. And i hope this helps you.

  • This is the old solution. This solution does NOT work on newer systemd based Linux operating systems, such as Fedora 19 or Current Arch. (I just tested it. There is not even a localauthority directory, and creating, the subfolder and the specified file do nothing). – senorsmile Oct 15 '13 at 14:51
  • @senorsmile Did you file a bug report with Fedora 19? – Pavel Šimerda Oct 15 '13 at 17:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.