Restricting Users from Specific Domains in QEMU/Libvirt without Polkit

Restricting Users to Specific Domains in QEMU/Libvirt without Polkit

In many cases, system administrators need to restrict users to specific domains in QEMU/Libvirt without using Polkit. This article will provide a detailed guide on how to achieve this goal, covering key concepts and subtitles.

Introduction

QEMU/Libvirt is a popular virtualization solution that allows users to create and manage virtual machines. However, sometimes administrators want to restrict users to specific domains, preventing them from accessing or modifying other domains. Polkit is a commonly used tool for delegating access to users running executables, but it may not always be the desired solution. In such cases, there are alternative methods to restrict users to specific domains.

Creating a Separate Group for Virtualization

The first step is to create a separate group for virtualization. This group will have the necessary permissions to manage virtual machines, while other users will be restricted to specific domains. To create a new group, use the following command:

sudo groupadd libvirt

Adding Users to the Virtualization Group

Next, add the users who need access to virtual machines to the newly created group. Use the following command to add a user to the group:

sudo usermod -a -G libvirt 

Creating a Bridge for Virtual Machines

To allow virtual machines to communicate with the host and the outside world, create a bridge for virtual machines. Use the following command to create a new bridge:

sudo ip link add name virbr0 type bridge

Configuring the Bridge

Configure the bridge to use the desired network settings. For example, to set the IP address and netmask, use the following commands:

sudo ip addr add dev virbr0 192.168.122.1/24

sudo ip link set virbr0 up

Configuring Libvirt to Use the Bridge

Configure Libvirt to use the newly created bridge for virtual machines. Use the following command to edit the Libvirt configuration file:

sudo nano /etc/libvirt/libvirtd.conf

Find the following line:

#listen_tls = 0

And change it to:

listen_tls = 0

listen_tcp = 1

auth_tcp = "none"

tcp_listen_port = "16509"

virbr0_vectors = "tcp:16509"

Save and close the file, then restart Libvirt to apply the changes:

sudo systemctl restart libvirtd

Creating a Virtual Machine for a Specific Domain

To create a virtual machine for a specific domain, use the following command:

sudo virt-install --name  --memory  --vcpus  --os-type linux --os-variant rhel7 --disk path=/var/lib/libvirt/images/.qcow2,size= --network bridge=virbr0 --graphics none --console pty,target_type=serial --import

Replace , , , with the desired values for the virtual machine. This command creates a virtual machine with the specified configuration and imports it into Libvirt.

Restricting Users to Specific Domains

Finally, restrict users to specific domains by creating a new Libvirt network for each domain. Use the following command to create a new network:

sudo virsh net-define /path/to/network-definition.xml

Replace /path/to/network-definition.xml with the path to the network definition file. The network definition file should specify the bridge and other network settings for the domain. Once the network is created, start it and attach it to the virtual machine:

sudo virsh net-start 

sudo virsh net-autostart 

sudo virsh dom
```