Bridge-less VM

[Laine Stump]

(look towards the bottom of the message for the "hidden lead" :-)


On 1/16/20 1:16 PM, Rob Roschewsk wrote:
> I'm trying to create a free standing VM that doesn't connect to a bridge.
> 
> This is supposedly do able according to the WIKI:
> https://libvirt.org/formatdomain.html#elementsNICSEthernet
> 
> But with a config similar to:
> 
>    <interface type='ethernet'>
>      <target dev='mytap1' managed='no'/>
>      <model type='virtio'/>
>    </interface>
> 
> When starting the domain I get the error:
> error: internal error: process exited while connecting to monitor: 
> 2020-01-16T18:08:04.788860Z qemu-system-x86_64: -netdev 
> tap,id=hostnet0,vhost=on,vhostfd=26: could not open /dev/net/tun: 
> Operation not permitted
> 
> Checked permissions on /dev/net/tunand it's 666
> 
> If I just configure it as a "bridge" connection the domain starts. Then 
> I can use brctl to remove it from the bridge to get what I want. That 
> just proves it possible but with extra steps (Shout out to Rick and Morty)
> 
> Thoughts??
> Running Ubuntu 16.04.1 Kernel 4.15.0-74
> libvirt 1.3.1-1ubuntu10.27

Oh, I see - you're running a version of libvirt that was released 
exactly 4 years ago today! You should notice in the web page you 
referenced above that <target dev='blah' managed='no'/> has only been 
supported since libvirt 5.7.0, which was released just last September. 
What you're running is incredibly ancient, and there is *a lot* of stuff 
documented on libvirt.org that it doesn't support (although we do try to 
note the minimum version required for any new feature).

Aside from missing the very recent "managed='no'" feature (which I think 
you probably don't need or even care about - you'd rather just let 
libvirt create the tap device for you, right?), the version of libvirt 
you're running doesn't even contain the very *old* commit 9c17d665fd 
(from March of 2016) which removed the necessity to run qemu as root 
when using <interface type='ethernet'>.

So you have two choices:

1) upgrade to a newer libvirt (something in the 5.x.0 or even 6.0.0 if 
possible). In this case you'll also probably want to remove the <target 
dev='blah' managed='no'/> line (unless you really do want give the 
device a specific name (controlled by "dev='blah'") and/or precreate the 
tap device yourself (controlled by "managed='no'").

2) change /etc/libvirt/qemu.conf to tell libvirt it should run qemu as 
user root and not clear the capabilities privileges for the qemu process 
(done by uncommenting 'user = "root"' and 'clear_emulator_capabilities = 
0'). This is a *VERY* bad idea, since 1) it allows the qemu process to 
run as root, meaning that if a virtual machine finds an exploit in your 
(*also* very old) qemu binary and "breaks out", it will have full root 
access to your host. Also in this case you will need to manually create 
the tap device beforehand (before commit 9c17d665fd libvirt would not 
auto-create a tap device for <interface type='ethernet'>).

I hope I've convinced you to take choice (1)!


> qemu 1:2.5+dfsg-5ubuntu10.41
> 
> Thanks,
> --> Rob
> 
> 
> 
>