Re: [libvirt-users] libvirtd via unix socket using system uri

On 29/04/2019 22.01, Michal Privoznik wrote: > On 4/29/19 1:06 PM, lameventanas(a)gmail.com wrote: >> I want to run libvirtd as a special user, and allowing users that belong >> to a special group to connect via qemu+unix:///system (eg: unix socket). >> >> I did everything necessary to do so: created a libvirt user and group, >> added the libvirt user to the kvm group, added my normal user to the >> libvirt group, and made sure the socket is owned by libvirt:libvirt with >> permissions set to 770. >> >> libvirtd starts successfully, but when I try to connect as the normal >> user I get this error: >> >> bash$ virsh --connect qemu+unix://system >> error: failed to connect to the hypervisor >> error: invalid argument: using unix socket and remote server 'system' is >> not supported. > > This is not valid URI. > > https://libvirt.org/uri.html > > You may want to use 'qemu+unix:///system' or simply 'qemu:///system' > which is the same because libvirt connects via unix socket by default. Thanks, I missed that. Now I get this: $ virsh --connect qemu:///system error: failed to connect to the hypervisor error: internal error: unexpected QEMU URI path '/system', try qemu:///session But now I see virsh opening the socket, writing, etc. The server log shows this: 2019-04-29 15:32:07.306+0000: 20863: info : libvirt version: 5.2.0 2019-04-29 15:32:07.306+0000: 20863: info : hostname: koji 2019-04-29 15:32:07.306+0000: 20863: error : virDBusGetSessionBus:169 : internal error: Unable to get DBus session bus connection: Unable to autolaunch a dbus-daemon without a $DISPLAY for X11 2019-04-29 15:32:24.534+0000: 20852: error : qemuConnectOpen:1127 : internal error: unexpected QEMU URI path '/system', try qemu:///session 2019-04-29 15:32:24.534+0000: 20851: error : virNetSocketReadWire:1803 : End of file while reading data: Input/output error I also wonder if dbus is important, and if so, how to fix it.

> Anyway, you'll need to run libvirtd privileged, otherwise it'll get > EPERM when trying to do almost anything. I'm aware of that, I want to try and see the limitations, and maybe get around them by using capabilities?