<div dir="ltr">Ok, excuse me for misunderstanding, how it is possible then to set up access control when I use remote connection to KVM ( not in UNIX domain)? Is there any way within libvirt, maybe based on authentication or certificates?<br></div><div class="gmail_extra"><br><div class="gmail_quote">2018-05-09 11:14 GMT+03:00 Daniel P. Berrangé <span dir="ltr"><<a href="mailto:berrange@redhat.com" target="_blank">berrange@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Wed, May 09, 2018 at 11:13:01AM +0300, Anastasiya Ruzhanskaya wrote:<br>
> I read this page <a href="https://libvirt.org/aclpolkit.html" rel="noreferrer" target="_blank">https://libvirt.org/aclpolkit.<wbr>html</a><br>
> And it is written :"At this point in time, the only attribute provided by<br>
> libvirt to identify the user invoking the operation is the PID of the<br>
> client program. This means that the polkit access control driver is only<br>
> useful if connections to libvirt are restricted to its UNIX domain socket."<br>
<br>
</span>You're mis-interpreted what that means. Libvirt provides the PID to polkit<br>
(well actually pid + starttime), polkit uses this to identify the process<br>
and determine its username and group membership, which is then used to<br>
make access control decisions.<br>
<div class="HOEnZb"><div class="h5"><br>
Regards,<br>
Daniel<br>
-- <br>
|: <a href="https://berrange.com" rel="noreferrer" target="_blank">https://berrange.com</a> -o- <a href="https://www.flickr.com/photos/dberrange" rel="noreferrer" target="_blank">https://www.flickr.com/photos/<wbr>dberrange</a> :|<br>
|: <a href="https://libvirt.org" rel="noreferrer" target="_blank">https://libvirt.org</a> -o- <a href="https://fstop138.berrange.com" rel="noreferrer" target="_blank">https://fstop138.berrange.com</a> :|<br>
|: <a href="https://entangle-photo.org" rel="noreferrer" target="_blank">https://entangle-photo.org</a> -o- <a href="https://www.instagram.com/dberrange" rel="noreferrer" target="_blank">https://www.instagram.com/<wbr>dberrange</a> :|<br>
</div></div></blockquote></div><br></div>