{"id":1024,"date":"2016-08-25T15:27:29","date_gmt":"2016-08-25T12:27:29","guid":{"rendered":"https:\/\/computingforgeeks.com\/?p=1024"},"modified":"2024-07-08T13:24:32","modified_gmt":"2024-07-08T10:24:32","slug":"use-virt-manager-as-non-root-user","status":"publish","type":"post","link":"https:\/\/computingforgeeks.com\/use-virt-manager-as-non-root-user\/","title":{"rendered":"Use virt-manager as a non-root user on Linux"},"content":{"rendered":"\n

The priority of KVM is security and by default it limits the management access to root users. If you want to run virt-manager<\/code> without being asked for sudo password, then this article is for you. We will be using a group with correct permissions to manage KVM, this enables you to grant multiple users in the system permissions to administer KVM hypervisor.<\/p>\n\n\n\n

In our previous guide we covered in detail the procedure of installing and configuring KVM hypervisor. With KVM installed and working, follow the steps below if you want to run Virt Manager without sudo<\/code> permissions.<\/p>\n\n\n\n

1) Create unix group for KVM<\/h2>\n\n\n\n

First check if group already exist, if not create it with commands below.<\/p>\n\n\n\n

sudo getent group | grep libvirt<\/code><\/pre>\n\n\n\n
Some distributions  may be using libvirtd.<\/p>\n\n\n\n
sudo getent group | grep libvirtd<\/mark><\/code><\/pre>\n\n\n\n
If the group does’t exist add using groupadd<\/code> command.<\/p>\n\n\n\n
sudo groupadd --system libvirt<\/code><\/pre>\n\n\n\n
2) Add users to the libvirt group<\/h2>\n\n\n\n
Add user to the group using the syntax.<\/p>\n\n\n\n
sudo usermod -a -G libvirt <username>\nnewgrp libvirt<\/code><\/pre>\n\n\n\n
Example of adding the current user account you are logged in as.<\/p>\n\n\n\n
sudo usermod -a -G libvirt $(whoami)
newgrp libvirt<\/code><\/pre>\n\n\n\n
Confirm that the user has been added to the group.<\/p>\n\n\n\n
$ id cloudspinx<\/mark>\nuid=1001(cloudspinx) gid=1001(cloudspinx) groups=1001(cloudspinx),986(libvirt)<\/code><\/pre>\n\n\n\n
3) Edit libvirtd configuration file<\/span><\/h2>\n\n\n\n
Open Libvirtd configuration file\u00a0\/etc\/libvirt\/libvirtd.conf<\/em>\u00a0for editing.<\/p>\n\n\n\n
# Using vim\nsudo vim \/etc\/libvirt\/libvirtd.conf\n\n# Using nano\nsudo nano \/etc\/libvirt\/libvirtd.conf<\/code><\/pre>\n\n\n\n
Find the  unix_sock_group<\/code> line and uncomment to define domain socket group ownership for libvirtd, (around line\u00a085<\/strong>)<\/p>\n\n\n\n
unix_sock_group = \"libvirt\"<\/code><\/pre>\n\n\n\n
Also assign UNIX socket permissions for the socket – we are setting R\/W (around line\u00a0102<\/strong>)<\/p>\n\n\n\n
unix_sock_rw_perms = \"0770\"<\/code><\/pre>\n\n\n\n
When done with the changes restart libvirtd<\/code> service.<\/p>\n\n\n\n
sudo systemctl restart libvirtd.service<\/code><\/pre>\n\n\n\n
Confirm service status:<\/p>\n\n\n\n
$ systemctl status libvirtd.service<\/mark>\n\u25cf<\/mark> libvirtd.service - Virtualization daemon\n   Loaded: loaded (\/usr\/lib\/systemd\/system\/libvirtd.service; enabled; vendor preset: enabled)\n   Active: active (running) <\/mark>since Mon 2024-07-08 13:02:26 EAT; 19min ago\n     Docs: man:libvirtd(8)\n           https://libvirt.org\n Main PID: 104329 (libvirtd)\n    Tasks: 27 (limit: 32768)\n   Memory: 94.5M\n   CGroup: \/system.slice\/libvirtd.service\n           \u251c\u2500  1737 \/usr\/sbin\/dnsmasq --conf-file=\/var\/lib\/libvirt\/dnsmasq\/crc.conf --leasefile-ro --dhcp-script=\/usr\/libexec\/libvirt_leaseshelper\n           \u251c\u2500  1739 \/usr\/sbin\/dnsmasq --conf-file=\/var\/lib\/libvirt\/dnsmasq\/crc.conf --leasefile-ro --dhcp-script=\/usr\/libexec\/libvirt_leaseshelper\n           \u251c\u2500  1815 \/usr\/sbin\/dnsmasq --conf-file=\/var\/lib\/libvirt\/dnsmasq\/default.conf --leasefile-ro --dhcp-script=\/usr\/libexec\/libvirt_leaseshelper\n           \u251c\u2500  1816 \/usr\/sbin\/dnsmasq --conf-file=\/var\/lib\/libvirt\/dnsmasq\/default.conf --leasefile-ro --dhcp-script=\/usr\/libexec\/libvirt_leaseshelper\n           \u2514\u2500104329 \/usr\/sbin\/libvirtd --timeout 120\n\nJul 08 13:02:26 kvm01.home.cloudlabske.io systemd[1]: Starting Virtualization daemon...\nJul 08 13:02:26 kvm01.home.cloudlabske.io systemd[1]: Started Virtualization daemon.\nJul 08 13:02:26 kvm01.home.cloudlabske.io dnsmasq[1815]: read \/etc\/hosts - 2 addresses\nJul 08 13:02:26 kvm01.home.cloudlabske.io dnsmasq[1737]: read \/etc\/hosts - 2 addresses\nJul 08 13:02:26 kvm01.home.cloudlabske.io dnsmasq[1737]: read \/var\/lib\/libvirt\/dnsmasq\/crc.addnhosts - 0 addresses\nJul 08 13:02:26 kvm01.home.cloudlabske.io dnsmasq[1815]: read \/var\/lib\/libvirt\/dnsmasq\/default.addnhosts - 0 addresses\nJul 08 13:02:26 kvm01.home.cloudlabske.io dnsmasq-dhcp[1815]: read \/var\/lib\/libvirt\/dnsmasq\/default.hostsfile\nJul 08 13:02:26 kvm01.home.cloudlabske.io dnsmasq-dhcp[1737]: read \/var\/lib\/libvirt\/dnsmasq\/crc.hostsfile<\/code><\/pre>\n\n\n\n
Launch virt-manager and test<\/h2>\n\n\n\n
Open your terminal and launch Virt Manager. You can also use GUI launcher.<\/p>\n\n\n\n
virt-manager<\/code><\/pre>\n\n\n\n
You should be able to connect without any permissions being asked.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
That’s all on how to allow non-root users to manage VMs on KVM using virsh<\/code>or virt-manager<\/code> without sudo permissions.<\/p>\n\n\n\n
Check more articles available on KVM.<\/p>\n\n\n\n