[libvirt-users] polkit ACL for remotely changing a spice console password

[David Mansfield]

I'm working on some infrastructure which allows a remote password reset 
(with expiry) of a spice console running on a remote libvirtd/qemu-kvm.

I currently have GSSAPI over tcp working and can set the password - but 
I can also do everything else - the default policy is still in place, 
and once authenticated, anything goes.

I'm setting the password using a command like this:

virsh --connect qemu+tcp://remote.example.org/system 
qemu-monitor-command --hmp mydomain 'set_password spice mynewpassword123 
disconnect'

I've looked at the documentation for ACLs but I can't see anything that 
covers qemu-monitor-command, and specifically "set_password".

The other way to set passwords is to update the domain settings using an 
XML fragment, but I'm not clear on the exact semantics on how to do that 
(do you have to extract the xml fragment first?) AND I can't find how 
that's covered in ACL documentation either.

Some idea? Any pointers would be much appreciated.

Ideally, I'd like to say "user x can update password for domain y" and 
that's the only thing that can be modified for that user.

-- 
Thanks,
David Mansfield
Cobite, INC.