- Users - libvirt List Archives

Recommendations for basic libvirt access control
by Nikolaus Rath 08 Dec '25

08 Dec '25

Hello, I noticed that (at least on my Fedora installation), adding a user to the libvirt group is equivalent to giving full root access (since the user can add arbitrary block devices to VMs, and then use the VM to modify the block device). Therefore, I'd like to give users more limited permissions - but I'm a bit lost about the best way to approach that. It seems that I could: - tighten (or relax) socket permissions in the systemd config - switch off socket activation and configure socket permissions in libvirtd.conf - Configure socket-dependent permissions in libvirt - Enable policykit ACL checks, and configure permissions there. Could someone give me a recommendation what (combination?) of these options would most suitable for a simple "users can interact with their predefined VMs" model? Ideally, users would be able to configure and interact with VMs that are assigned to them, without having access to operations that are trivially root-equivalent (like adding new storage devices from the host). If that's difficult, I'd also settle for a simpler model where users can't change VM permissions at all, and are limited to starting, stopping, and connecting to the console of their VM. What's the best way to accomplish that? Best, -Nikolaus

4 4

libvirt access control
by nikolaus＠rath.org 06 Dec '25

06 Dec '25

Hello, I'm puzzled by how libvirtd manages access control. As far as I can tell, on my Fedora system it runs qemu and virtiofsd instances as user qemu. Yet, the qemu process apparently has read/write access to storage devices in /dev that only root has rw access for. Similarly, virtiofsd is able to write into shared directories that the qemu user does not have access to (confirmed by switching to qemu user with sudo). What is libvirtd (or virt-manager) doing to make this work? Then, as far as I can tell, there's lots of sockets with different permissions created by systemd in /run/libvirt (e.g. libvirt-admin-sock, libvirt-sock, libvirt-sock-ro). But since they're all passed to libvirtd as open file descriptors, I don't understand how they can give different levels of access (since libvirtd has no way of knowing which socket was used). What am I missing? Best, -Nikolaus

5 8

libvirt access control
by Nikolaus Rath 04 Dec '25

04 Dec '25

Hello, I'm puzzled by how libvirtd manages access control. As far as I can tell, on my Fedora system it runs qemu and virtiofsd instances as user *qemu*. Yet, the qemu process apparently has read/write access to storage devices in /dev that only root has rw access for. Similarly, virtiofsd is able to write into shared directories that the qemu user does not have access to (confirmed by switching to qemu user with sudo). What is libvirtd (or virt-manager) doing to make this work? Then, as far as I can tell, there's lots of sockets with different permissions created by systemd in /run/libvirt (e.g. libvirt-admin-sock, libvirt-sock, libvirt-sock-ro). But since they're all passed to libvirtd as open file descriptors, I don't understand how they can give different levels of access (since libvirtd has no way of knowing which socket was used). What am I missing? Best, -Nikolaus

1 0

virDomainBlockCommit for offline domains
by melanie witt 13 Nov '25

13 Nov '25

Hi, I am trying to find info about whether block commit of an offline domain is possible? Historically I know it was not supported and I wanted to confirm whether that is still the case. I did not notice mention about the limitation in the libvirt domain API docs or in the virsh docs. I'm investigating in the context of OpenStack Nova -- we have had a feature request brought back up recently to be able to delete an "intermediary" image in a backing chain while the VM is shutdown. And from what I understand, we would need to be able to call virDomainBlockCommit for a domain that is not running [1] as part of it. So I'm just looking to learn about the current state of support. Thanks for any information, -melwitt [1] https://bugs.launchpad.net/nova/+bug/1919487

2 2

Linux bridge VLANs
by Ian Pilcher 12 Nov '25

12 Nov '25

Do recent versions of libvirt support configuring VLANs (truck and access ports) on Linux bridges? I've been using OVS bridges for a long time (because Linux bridges didn't even do VLANs when I started). Linux bridges should theoretically be a bit simpler, but I can't tell from the libvirt documentation if libvirt ever gained the ability to do VLANs with Linux bridges. -- ======================================================================== Google Where SkyNet meets Idiocracy ========================================================================

2 2

Re: Compact backing chain (sparsify + compress)
by Markus Armbruster 10 Nov '25

10 Nov '25

Adding cc:s. Christopher Pereira <kripper(a)imatronix.cl> writes: > Hi, > > I would like to revisit this old thread from 2016 with a special use case that I believe should be a standard `virsh` command: > https://lists.gnu.org/archive/html/qemu-devel/2016-12/msg03571.html > > **Summary:** > > Given this QEMU backing chain: > `base <- snap1 <- snap2 <- snap3 (active)` > > We want to merge `base <- snap1 <- snap2` into a new snapshot `collapsed-base` that is: > 1. Sparsified (`virt-sparsify`) > 2. Compressed > > The resulting backing chain would be: > `collapsed-base <- snap3 (active)` > > **Motivation:** > > - We perform daily backup snapshots and never modify existing files (too dangerous). We only rebase. > - We collapse older chains into a new `collapsed-base` snapshot to limit chain size and avoid performance degradation. > > We have been doing this successfully for over 10 years using: > > - `qemu-img convert` > - `virt-sparsify` > - `virsh save` > - `qemu-img rebase` > - `virsh resume` > > **Problems:** > > - There is a small downtime due to `virsh save`/`resume`. > - In recent QEMU versions, `virsh` adds a `backingStore` tag to the XML even when using the `--no-metadata` option. This causes inconsistencies after `qemu-img rebase`. > > We didn’t use QMP because it didn’t support sparsify + compression in the past. > > **Questions:** > > - Is there now a better way to achieve this? > - Could this feature be implemented or supported directly in `virsh`? > > In my opinion, this would be the ideal backup solution: we could travel in time, sync immutable snapshots to a remote backup server, and maintain performance.

2 1

Co-stop with non-VMware virtualization?
by Troels Arvin 04 Nov '25

04 Nov '25

Hello, How important is it to consider "co-stop" with non-VMWare virtualization such as KVM? I haven't been able to find anything about this for KVM, but there's some material about it for VMWare (albeit typically rather old material). Based on VMWare material, by "co-stop" I mean the following situation: A VM called "x" has been assigned quite a few vCPUs, e.g. 10, on a hypervisor with e.g. 20 physical cores. The hypervisor is hosting many other VMs, and the many VMs take turn running on the hardware. Now, if it's often the case that, e.g., only 7 physical threads are available when it's x's turn to run, the hypervisor needs to postpone running x till all 10 cores can be allocated at the same time. During this waiting time, x is stopped (co-stop). Is my understanding correct? Or will KVM allow x to run on (e.g.) 7 cores, even though the VM thinks it has 10 vCPUs available? It's my understanding that with KVM, the co-stopped situation is reflected in the VM's "steal time" metric in a tool like "top". Does hyperthreading in either the hypervisor and/or the guest impact the risk of co-stop? -- Regards, Troels Arvin

3 2

[FOSDEM] Call for participation: Virtualization and Cloud infrastructure Room at FOSDEM 2026
by Piotr Kliczewski 28 Oct '25

28 Oct '25

We are excited to announce that the call for proposals is now open for the Virtualization and Cloud infrastructure devroom at the upcoming FOSDEM 2026, to be hosted on 31st of January. This devroom is a collaborative effort, and is organized by dedicated folks from projects such as OpenStack, Xen Project, KubeVirt, QEMU, KVM, and Foreman. We invite everyone involved in these fields to submit your proposals by 5th December 2025. About the Devroom The Virtualization & IaaS devroom will feature session topics such as open source hypervisors or virtual machine managers such as Xen Project, KVM, bhyve and VirtualBox as well as Infrastructure-as-a-Service projects such as KubeVirt, Apache CloudStack, OpenStack, QEMU and OpenNebula. This devroom will host presentations that focus on topics of shared interest, such as KVM, libvirt, shared storage, virtualized networking, cloud security, clustering and high availability, interfacing with multiple hypervisors, hyperconverged deployments and scaling across hundreds or thousands of servers. Presentations in this devroom will be aimed at developers working on these platforms who are looking to collaborate and improve shared infrastructure or solve common problems. We seek topics that encourage dialog between projects and continued work post-FOSDEM. Important Dates Submission deadline: 5th December 2025 Acceptance notifications: 10th December 2025 Final schedule announcement: 15th of December 2025 Devroom: 31st of January Submit Your Proposal During submission [1] please make sure to select Virtualization and Cloud infrastructure from the Track list. Please provide a meaningful abstract and description of your proposed session. Submission Guidelines We expect more proposals than we can possibly accept, so it is vitally important that you submit your proposal on or before the deadline. Late submissions are unlikely to be considered. All presentation slots are 30 minutes, with 20 minutes planned for presentations, and 10 minutes for Q&A. All presentations will be recorded and made available under Creative Commons licenses. In the Submission notes field, please indicate that you agree that your presentation will be licensed under the CC-By-SA-4.0 or CC-By-4.0 license and that you agree to have your presentation recorded. For example: "If my presentation is accepted for FOSDEM, I hereby agree to license all recordings, slides, and other associated materials under the Creative Commons Attribution Share-Alike 4.0 International License. Sincerely, Piotr Kliczewski and Tal Nisan In the Submission notes field, please also confirm that if your talk is accepted, you will be able to attend FOSDEM and deliver your presentation. We will not consider proposals from prospective speakers who are unsure whether they will be able to secure funds for travel and lodging to attend FOSDEM. (Sadly, we are not able to offer travel funding for prospective speakers.) Code of Conduct Following the release of the updated code of conduct for FOSDEM[2], we'd like to remind all speakers and attendees that all of the presentations and discussions in our devroom are held under the guidelines set in the CoC and we expect attendees, speakers, and volunteers to follow the CoC at all times. If you submit a proposal and it is accepted, you will be required to confirm that you accept the FOSDEM CoC. If you have any questions about the CoC or wish to have one of the devroom organizers review your presentation slides or any other content for CoC compliance, please email us and we will do our best to assist you. Questions? If you have any questions about this devroom, please send your questions to our devroom mailing list. You can also subscribe to the list to receive updates about important dates, session announcements, and to connect with other attendees. See you all at FOSDEM! [1] https://fosdem.org/submit [2] https://fosdem.org/2026/practical/conduct/

1 0

Gueat with secure boot & PXE ?
by lejeczek 22 Oct '25

22 Oct '25

Hi guys. I'm trying to boot securely a guest - ultimately will be Windows, I hear only secure boot for win11 - via PXE but I fail to figure it out - my first foray into it. VM fails with: iPXE initialising devices... autoexec. ipxe... Not found (https:// ipxe .org/2d12618e iPXE 1.21.1+ (g5c49e) -- Open Source Network Boot Firmware —- https://ipxe.org Features: DNS HITP iSCSI TETP ULAN SRP AoE EFI Menu net@: 02:2d:7a:34:9f:90 using virtio-net on 0000:01:00.0 (Ethernet) [open] ULink:up, T:@ TKE:1 RX:@ RXE:0] ITKE: 1 x "Netuork unreachable (https://ipxe .org/28086090) "] Configuring (net 02:2d:7a:34:9F:90) ...... ok netO: 10.3.1.14/255.255.252.0 gu 10.3.1.254 netO: fe80::2d: Taff: fe34:9£90/64 Next server: 10.3.1.99 Filenane: ipxe-shinx64-ef i t£tp://10.3.1.99/ ipxe-shimx64-ef i... ok ipxe-shinx64.efi : 961448 bytes [EFI] Fetching Netboot Inage ipxe-efi Nalforned binary after Attribute Certificate Table datasize: 4194304 SunOfBytesHashed: 1044480 SecDir->Size: 1536 hashsize: 3148288 SecDir->VirtualAddress: 0x000FFO00 Failed to load image: Invalid Paraneter start_imageQ returned Invalid Paraneter, falling back to default loader Fetching Netboot Inage ipxe-efi Nalforned binary after Attribute Certificate Table datasize: 4194304 SunOfBytesHashed: 1044480 SecDir->Size: 1536 hashsize: 3148288 SecDir-VirtualAddress: 0x000FFO00 Failed to load inage: Invalid Paraneter start_imageQ returned Invalid Paraneter Guest domain is like so: ... <firmware> <feature enabled='no' name='enrolled-keys'/> <feature enabled='no' name='secure-boot'/> </firmware> <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/dzien-win-secbot_VARS.fd</nvram> ... Here boot is not secure secure - but when is secure, also fails - so I could capture pxe process which is more verbose here, as opposed to secure which pop-ups with blue screen with only a short message. I'm presuming I sign something - bootloaders |& efi vars store - wrong? I'm on centos 9 with biners up-to-today. Any/all thoughts are much appreciated. many thanks, L.

1 0

download certificate issue
by daan.hoogland＠gmail.com 20 Oct '25

20 Oct '25

we (apache/cloudstack) are seeing issues downloading libvirt java 0.5.3 lately. It seems to be due to certificates errors on downloads.libvirt.org . I am not sure what the appropriate way to report this is, so asking here first. regards, Daan Hoogland

2 1