我将 libvirt 配置为使用“users”组来运行虚拟机
grep -w users /etc/libvirt/qemu.conf
# unix socket. This prevents unprivileged access from users on the
# unix socket. This prevents unprivileged access from users on the
group = "users"
# deployments. It is strongly recommended that users update their
我可以毫无问题地从用户启动虚拟机,它们运行..但是ps说..以root身份运行而不是作为我的非特权用户运行,为什么?
ps -ef|grep qemu
root 15248 1 33 14:53 ? 00:01:05 /usr/bin/qemu-kvm -name guest=
是否可以以非特权用户身份运行虚拟机?发行版是 slackware 14.2,当然我在用户组中
答案1
找到解决方案。
首先在 libvirt SlackBuild 上,添加或修改这些行
VIRTGROUP=${VIRTGROUP:-kvm}
./configure \
--prefix=/usr \
--libdir=/usr/lib${LIBDIRSUFFIX} \
--bindir=/usr/sbin \
--sbindir=/usr/sbin \
--disable-static \
--sysconfdir=/etc \
--localstatedir=/var \
--mandir=/usr/man \
--docdir=/usr/doc/$PRGNAM-$VERSION \
--enable-static=no \
--enable-shared=yes \
--with-qemu-group=$VIRTGROUP \
--with-qemu-user=nobody \
--without-hal \
--with-interface \
--with-lxc \
--with-udev \
--with-storage-disk \
--with-storage-gluster \
--with-storage-lvm \
--with-init-script=none
# udev rules
mkdir -p $PKG/etc/udev/rules.d/65-kvm.rules
install -D -m 0644 $CWD/65-kvm.rules $PKG/etc/udev/rules.d/65-kvm.rules
udev规则必须是这样的
cat /etc/udev/rules.d/65-kvm.rules
KERNEL=="kvm", NAME="%k", GROUP="kvm", MODE="0660"
不要忘记 polkit 部分,否则 libvirt 只能以 root 身份运行
cat /usr/share/polkit-1/rules.d/50-libvirt.rules
// Allow any user in the 'libvirt' group to connect to system libvirtd
// without entering a password.
polkit.addRule(function(action, subject) {
if (action.id == "org.libvirt.unix.manage" &&
subject.isInGroup("libvirt")) {
return polkit.Result.YES;
}
});
重新启动 libivirt ps 后,为 qemu 用户返回无人
ps -o user,group,cmd -p 14123
USER GROUP CMD
nobody kvm /usr/bin/qemu-kvm -name guest=..