F16 guestfs-browser as non-root

[Frank Murphy]

Getting permission denied.
When loading guests as non-root

Have made a pkla, in
/var/lib/polit-1/localauthority/50-local.d/guestfs-browser.pkla

[Local guestfs-browser Permissions]
Identity=unix-user:frank
Action=org.libguestfs.unix.*
ResultAny=no
ResultInactive=no
ResultActive=yes

Have also tried:
Action=org.guestfs.unix.*
Action=org.libvirt.unix.*


-- 
Regards,
Frank
"Jack of all, fubars"

[Richard W.M. Jones]

On Sun, Apr 01, 2012 at 11:00:08AM +0100, Frank Murphy wrote:
>  Getting permission denied.
>  When loading guests as non-root
>  
>  Have made a pkla, in
>  /var/lib/polit-1/localauthority/50-local.d/guestfs-browser.pkla
>  
>  [Local guestfs-browser Permissions]
>  Identity=unix-user:frank
>  Action=org.libguestfs.unix.*
>  ResultAny=no
>  ResultInactive=no
>  ResultActive=yes
>  
>  Have also tried:
>  Action=org.guestfs.unix.*
>  Action=org.libvirt.unix.* 
What's the actual, complete error message?

What's the output when you use:

  export LIBGUESTFS_TRACE=1

How about if you use:

  export LIBVIRT_DEBUG=1

libguestfs itself doesn't use PolicyKit, so it's doubtful that
creating that .pkla file is having any effect whatsoever.  libvirt
uses PolicyKit, and libguestfs uses libvirt to get a list of local
guests, so a *libvirt* .pkla file may be necessary, but without
knowing what the error is, it's hard to tell.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-df lists disk usage of guests without needing to install any
software inside the virtual machine.  Supports Linux and Windows.
http://et.redhat.com/~rjones/virt-df/

[Frank Murphy]

On 02/04/12 11:29, Richard W.M. Jones wrote:
>  What's the actual, complete error message?
>
>  What's the output when you use:
>
>     export LIBGUESTFS_TRACE=1
>
>  How about if you use:
>
>     export LIBVIRT_DEBUG=1 
guestfs-browser -x
libguestfs: trace: add_drive_opts 
"/var/lib/libvirt/images/01-Old-32.img" "readonly:true"
"format:raw"
libguestfs: trace: add_drive_opts = -1 (error)
libguestfs: trace: close

Both give above.

ls -l /var/lib/libvirt/images
total 335544764
-rw-------. 1 root root 42949672960 Apr  2 11:32 01-Old-32.img
-rw-------. 1 root root 42949672960 Apr  2 09:30 02-Old-64.img
-rw-------. 1 root root 42949672960 Apr  2 09:53 03-Current-32.img
-rw-------. 1 root root 42949672960 Apr  2 10:02 04-urrent-64.img
-rw-------. 1 root root 42949672960 Apr  2 10:12 05-Branched-32.img
-rw-------. 1 root root 42949672960 Apr  2 10:20 06-Branched-64.img
-rw-------. 1 root root 42949672960 Apr  2 08:31 07-Rawhide-32.img
-rw-------. 1 root root 42949672960 Apr  2 08:49 08-Rawhide-64.img


Virt-Manager doesn't have the "readonly" checked in the virtio disk

>  libguestfs itself doesn't use PolicyKit, so it's doubtful that
>  creating that .pkla file is having any effect whatsoever.  libvirt
>  uses PolicyKit, and libguestfs uses libvirt to get a list of local
>  guests, so a *libvirt* .pkla file may be necessary, but without
>  knowing what the error is, it's hard to tell.
>
>  Rich.
>  
There is a libvirt.pkla in place.

-- 
Regards,
Frank
"Jack of all, fubars"

[Richard W.M. Jones]

On Mon, Apr 02, 2012 at 11:49:44AM +0100, Frank Murphy wrote:
>  On 02/04/12 11:29, Richard W.M. Jones wrote:
>  >What's the actual, complete error message?
>  >
>  >What's the output when you use:
>  >
>  >   export LIBGUESTFS_TRACE=1
>  >
>  >How about if you use:
>  >
>  >   export LIBVIRT_DEBUG=1
>  
>  guestfs-browser -x
>  libguestfs: trace: add_drive_opts
>  "/var/lib/libvirt/images/01-Old-32.img" "readonly:true"
> "format:raw"
>  libguestfs: trace: add_drive_opts = -1 (error)
>  libguestfs: trace: close
>  
>  Both give above.
>  
>  ls -l /var/lib/libvirt/images
>  total 335544764
>  -rw-------. 1 root root 42949672960 Apr  2 11:32 01-Old-32.img
>  -rw-------. 1 root root 42949672960 Apr  2 09:30 02-Old-64.img
>  -rw-------. 1 root root 42949672960 Apr  2 09:53 03-Current-32.img
>  -rw-------. 1 root root 42949672960 Apr  2 10:02 04-urrent-64.img
>  -rw-------. 1 root root 42949672960 Apr  2 10:12 05-Branched-32.img
>  -rw-------. 1 root root 42949672960 Apr  2 10:20 06-Branched-64.img
>  -rw-------. 1 root root 42949672960 Apr  2 08:31 07-Rawhide-32.img
>  -rw-------. 1 root root 42949672960 Apr  2 08:49 08-Rawhide-64.img 
Right ...  libguestfs just opens the disk image and so needs
sufficient permission, or that the disk permission is changed which it
looks like you did.

I normally use logical volumes for guests, and adding my user account
to the 'disk' group gives me access to those without needing root.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming blog: http://rwmj.wordpress.com
Fedora now supports 80 OCaml packages (the OPEN alternative to F#)
http://cocan.org/getting_started_with_ocaml_on_red_hat_and_fedora

SOLVED Re: F16 guestfs-browser as non-root

[Frank Murphy]

On 01/04/12 11:00, Frank Murphy wrote:

chown -R root:user /var/lib/libvirt/images
chmod -R 660  /var/lib/libvirt/images


-- 
Regards,
Frank
"Jack of all, fubars"