[PATCH] polkit: Allow libvirt group access to libvirtd ro socket

[Jim Fehlig]

As a normal user, 'virsh connect qemu:///system' and
'virsh connect --readonly qemu:///system' will prompt for root password.
If the user is added to the libvirt group, only
'virsh connect --readonly qemu:///system' will prompt for root password.

The libvirt polkit rules already allow libvirt group members access to
the rw socket. Add a rule allowing to access the ro socket.

Signed-off-by: Jim Fehlig <jfehlig at suse.com>
---
 src/remote/libvirtd.rules | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/remote/libvirtd.rules b/src/remote/libvirtd.rules
index 01a15fac2e..d9be94fcc4 100644
--- a/src/remote/libvirtd.rules
+++ b/src/remote/libvirtd.rules
@@ -1,5 +1,12 @@
-// Allow any user in the 'libvirt' group to connect to system libvirtd
-// without entering a password.
+// Allow any user in the 'libvirt' group to connect to the system libvirtd
+// ro and rw sockets without entering a password.
+
+polkit.addRule(function(action, subject) {
+    if (action.id == "org.libvirt.unix.monitor" &&
+        subject.isInGroup("libvirt")) {
+        return polkit.Result.YES;
+    }
+});
 
 polkit.addRule(function(action, subject) {
     if (action.id == "org.libvirt.unix.manage" &&
-- 
2.29.2