<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office"><head></head><body><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div id="ydp399622f5yiv8001050237"><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr">Hi All,<br><br>I am trying to implement the following use case.<br><br>User sfrag is logged on the host via ssh.<br>Running 'virsh list --all' should trigger PolKit authentication and present ALL domains suffixed with -SF</div><div dir="ltr"><br></div><div dir="ltr" data-setdir="false">I have used and adapted the example from: <a href="https://libvirt.org/git/?p=libvirt.git;a=blob;f=examples/polkit/libvirt-acl.rules;h=dd6836599adb6b696d76756fb3d25a045fec12e0;hb=HEAD" rel="nofollow" target="_blank" class="enhancr_card_7003859678">libvirt.org Git - libvirt.git/blob - examples/polkit/libvirt-acl.rules</a></div><div><br></div><div id="ydp38747c2aenhancr_card_7003859678" class="ydp38747c2ayahoo-link-enhancr-card ydp38747c2aymail-preserve-class ydp38747c2aymail-preserve-style" style="max-width:400px;font-family:Helvetica Neue, Segoe UI, Helvetica, Arial, sans-serif" data-url="https://libvirt.org/git/?p=libvirt.git;a=blob;f=examples/polkit/libvirt-acl.rules;h=dd6836599adb6b696d76756fb3d25a045fec12e0;hb=HEAD" data-type="YENHANCER" data-size="MEDIUM" contenteditable="false"><a href="https://libvirt.org/git/?p=libvirt.git;a=blob;f=examples/polkit/libvirt-acl.rules;h=dd6836599adb6b696d76756fb3d25a045fec12e0;hb=HEAD" style="text-decoration:none !important;color:#000 !important" class="ydp38747c2ayahoo-enhancr-cardlink" rel="nofollow" target="_blank"><table border="0" class="ydp38747c2acard-wrapper ydp38747c2ayahoo-ignore-table" cellpadding="0" cellspacing="0" style="max-width:400px"><tbody><tr><td width="400"><table border="0" class="ydp38747c2acard ydp38747c2ayahoo-ignore-table" cellpadding="0" cellspacing="0" width="100%" style="max-width:400px;border-width:1px;border-style:solid;border-color:rgb(224, 228, 233);border-radius:2px"><tbody><tr><td class="ydp38747c2acard-primary-image-cell" background="https://s.yimg.com/lo/api/res/1.2/wGFW.xt2yzyOU4PN3WMHfw--~A/Zmk9ZmlsbDt3PTQwMDtoPTIwMDthcHBpZD1pZXh0cmFjdA--/https://libvirt.org/git-logo.png.cf.jpg" bgcolor="#000000" valign="top" height="175" style="background-color: rgb(0, 0, 0); background-size: cover; position: relative; border-radius: 2px 2px 0px 0px; min-height: 175px;"><table border="0" class="ydp38747c2acard-overlay-container-table ydp38747c2ayahoo-ignore-table" cellpadding="0" cellspacing="0" style="width:100%"><tbody><tr><td class="ydp38747c2acard-overlay-cell" background="https://s.yimg.com/cv/ae/nq/storm/assets/enhancrV21/1/enhancr_gradient-400x175.png" bgcolor="transparent" valign="top" style="background-color: transparent; border-radius: 2px 2px 0px 0px; min-height: 175px;"><table border="0" class="ydp38747c2ayahoo-ignore-table" height="175" style="width: 100%; min-height: 175px;"><tbody><tr><td class="ydp38747c2acard-richInfo2" style="text-align:left;padding:15px 0 0 15px;vertical-align:top"></td><td class="ydp38747c2acard-actions" style="text-align:right;padding:15px 15px 0 0;vertical-align:top"><div class="ydp38747c2acard-share-container"></div></td></tr></tbody></table></td></tr></tbody></table></td></tr><tr><td><table border="0" align="center" class="ydp38747c2acard-info ydp38747c2ayahoo-ignore-table" cellpadding="0" cellspacing="0" style="background:#fff;position:relative;z-index:2;width:100%;max-width:400px;border-radius:0 0 2px 2px;border-top:1px solid rgb(224, 228, 233)"><tbody><tr><td style="background-color:#ffffff;padding:16px 0 16px 12px;vertical-align:top;border-radius:0 0 0 2px"></td><td style="vertical-align:middle;padding:12px 24px 16px 12px;width:99%;font-family:Helvetica Neue, Segoe UI, Helvetica, Arial, sans-serif;border-radius:0 0 2px 0"><h2 class="ydp38747c2acard-title" style="font-size: 14px; line-height: 19px; margin: 0px 0px 6px; font-family: Helvetica Neue, Segoe UI, Helvetica, Arial, sans-serif; color: rgb(38, 40, 42); max-width: 314px;">libvirt.org Git - libvirt.git/blob - examples/polkit/libvirt-acl.rules</h2><p class="ydp38747c2acard-description" style="font-size: 12px; line-height: 16px; margin: 0px; color: rgb(151, 155, 167);"></p></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></a></div><div><br></div><div><br></div><div dir="ltr" data-setdir="false">Adapted the setup so that I included user sfrag.<br><br>Always the user was asked to authenticate via root and not via SELF but ONLY if running "virsh -c qemu:///system list --all"</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Had to change /etc/libvirt/libvirtd.conf to include:<br></div><div dir="ltr" data-setdir="false"><br></div></div></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div dir="ltr" data-setdir="false"><span>auth_unix_ro = "polkit"</span></div></div></div></div></div></div><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div dir="ltr" data-setdir="false"><div><div>access_drivers = [ "polkit" ]</div></div></div></div></div></div></div></div><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div dir="ltr" data-setdir="false">log_filters="1:access.accessdriverpolkit"</div></div></div></div></div><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div>log_outputs="1:file:/var/log/libvirt/libvirtd.log"</div></div><div><br></div><div><br></div></div></div></div></blockquote><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div dir="ltr" data-setdir="false"><span style="color: rgb(0, 0, 0); font-family: Helvetica Neue, Helvetica, Arial, sans-serif;">All polkit rules for user sfrag was removed at this point.</span><br style="color: rgb(0, 0, 0); font-family: Helvetica Neue, Helvetica, Arial, sans-serif;"></div><br></div><div dir="ltr" data-setdir="false">Now the user sfrag running 'virsh list --all' gives no output to /var/log/libvirt/libvirtd.log or /var/log/secure.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Running the same as user root gives interesting results in the logs:<br></div></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div class="ydpfbe137c6linestyle2 ydpfbe137c6colourline"><br></div><div class="ydpfbe137c6linestyle2 ydpfbe137c6colourline">org.libvirt.api.connect.getattr</div></div></div></div></div><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div class="ydpfbe137c6linestyle1 ydpfbe137c6colourline">org.libvirt.api.connect.search-domains</div></div></div></div></div><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div class="ydpfbe137c6linestyle2 ydpfbe137c6colourline" dir="ltr" data-setdir="false">org.libvirt.api.domain.getattr (fore every defined domain)</div></div></div></div></div><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div class="ydpfbe137c6linestyle1 ydpfbe137c6colourline" dir="ltr" data-setdir="false">org.libvirt.api.domain.read (again for every defined domain).</div></div></div></div></div></blockquote><div class="ydp399622f5yahoo-style-wrap" style="font-family: Helvetica Neue, Helvetica, Arial, sans-serif; font-size: 13px;"><div class="ydp399622f5yiv8001050237yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div dir="ltr" data-setdir="false"><div><div class="ydpfbe137c6linestyle1 ydpfbe137c6colourline" dir="ltr" data-setdir="false"><br></div></div><br>Virsh is using qemu:///session as the default URI.<br><br>Why running virsh as non-root is not triggering polkit or any API calls (based on log files output) and running the same as root, gives all the interesting output? <br><br>Which implies that running virsh as root results in different actions compaired to calling it as non root.<br><br>Thank you for Your time.<br><br>BR<br>Theophanis Kontogiannis</div><div dir="ltr" data-setdir="false"><br><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div></div></div></body></html>