Re: [libvirt] problems with remote authentication with policykit
Daniel P. Berrange wrote:
On Wed, Jun 17, 2009 at 05:51:27PM -0400, Jim Paris wrote:
> Daniel P. Berrange wrote:
> 17:34:59.360: debug : call:6947 : Doing call 70 (nil)
> 17:34:59.360: debug : call:7017 : We have the buck 70 0xbccef0 0xbccef0
> 17:34:59.433: debug : processCallRecvLen:6605 : Got length, now need 128 total (124
more)
> 17:34:59.434: debug : processCalls:6873 : Giving up the buck 70 0xbccef0 (nil)
> 17:34:59.434: debug : call:7048 : All done with our call 70 (nil) 0xbccef0
> 17:34:59.434: error : server_error:7231 : authentication failed
> 17:35:13.585: debug : do_open:999 : driver 4 remote returned ERROR
> 17:35:13.585: debug : virUnrefConnect:232 : unref connection 0xbc6a60 1
> 17:35:13.585: debug : virReleaseConnect:191 : release connection 0xbc6a60
>
> If I kill the libvirtd process on the server, the client then finally prints:
>
> error: authentication failed
> error: failed to connect to the hypervisor
>
> and the client then exits.
Ok, this bit definitely sounds like a server side bug, unless
perhaps there is some buffering taking place in ssh or nc
causing the errore reply packet to not be send back promptly
I'll try to get some better traces of what's going on here.
> The hang aside, it seems libvirtd should be using
> org.libvirt.unix.monitor for the readonly connection?
In this case the problem is that the remote client end is using
netcat on the wrong UNIX socket.
Thanks, that's it. With the attached patch on the client side,
virsh --readonly and virt-viewer work fine over qemu+ssh://.
-jim
--- libvirt-0.6.4-orig/src/remote_internal.c 2009-05-29 10:55:26.000000000 -0400
+++ libvirt-0.6.4/src/remote_internal.c 2009-06-17 18:21:34.000000000 -0400
@@ -700,7 +700,10 @@
cmd_argv[j++] = strdup (priv->hostname);
cmd_argv[j++] = strdup (netcat ? netcat : "nc");
cmd_argv[j++] = strdup ("-U");
- cmd_argv[j++] = strdup (sockname ? sockname : LIBVIRTD_PRIV_UNIX_SOCKET);
+ cmd_argv[j++] = strdup (sockname ? sockname :
+ (flags & VIR_CONNECT_RO
+ ? LIBVIRTD_PRIV_UNIX_SOCKET_RO
+ : LIBVIRTD_PRIV_UNIX_SOCKET));
cmd_argv[j++] = 0;
assert (j == nr_args);
for (j = 0; j < (nr_args-1); j++)