I believe I have gotten all of Dan B comments implemented, with a couple of changes. 1. I no longer allow root to execute the command. 2. Rather then allow the globbing syntax for allowed_users in the config, I added the abiltiy to specify groups. [PATCH] virt-login-shell joins users into lxc container.