[libvirt-users] selective virsh host permissions

Daniel P. Berrange berrange at redhat.com
Tue Oct 20 08:30:58 UTC 2015

On Mon, Oct 19, 2015 at 01:10:15PM -0400, Jamie Fargen wrote:
> As a Systems Administrator, I would like to grant permissions to a certain
> VM using unix groups. In this example there is a hypervisor with VMs
> A,B,C,D and there is a group called fortadmins. The solution I am searching
> forI would just allow fortadmins to use libvirt/virsh commands on VM D.
> Does libvirt/virsh provide any way to easily accomplish this goal?

You can accomplish this using polkit


Please note, however, that you should not grant the ability to define XML
or otherwise make changes to the guest XML, as this privilege is effectively
equivalant to having root.

Giving users the ability to start/stop VMs is just fine. You can even
prevent users from seeing each other's VMs by restricting the 'getattr'
and 'read' privileges.

In current libvirt GIT there is a example file 'examples/polkit/libvirt-acl.rules'

|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|

More information about the libvirt-users mailing list