Virt Manager PolicyKit integration
Summary
The virt-manager application currently runs as root when managing a local hypervisor. It uses console-helper to authentication from a desktop session. Running GTK applications as root is evil. By integrating with PolicyKit it will be possible to run virt-manager as a regular user
Owner
- Name: DanielBerrange
Current status
- Targeted release: Fedora 9
- Last updated: 2008-03-15
- Percentage of completion: 100%
Detailed Description
The virt-manager application currently runs as root when managing a local hypervisor. It uses console-helper to authentication from a desktop session. Running GTK applications as root is evil. virt-manager can also be used to remotely manage guests on another server, in which case running as root is even less desirable. By integrating with PolicyKit it will be possible to run virt-manager as a regular user, while securely authenticating against a local libvirt daemon. The storage management APIs will enable virt-manager to create new guests will running as non-root.
Benefit to Fedora
PolicyKit is replacing console-helper as the defacto mechanism for local management applications to gain privileges. Virt-manager should take full advantage of PolicyKit to run unprivileged in the local desktop session.
Scope
- Add PolicyKit authentication mechanism to libvirt daemon (in rawhide in libvirt 0.4.0)
- Extend virt-manager to talk to PolicyKit GNOME helper via DBus to authenticate (merged upstream, pending next virt-manager release)
Test Plan
- Install a Fedora 9 instance with either KVM or Xen hypervisors enabled
- Run virt-manager from a GNOME desktop session
- Attempt to connect to the local hypervisor using virt-manager
- Enter any authentication credentials requested by PolicyKit
- Observe that virt-manager is running as non-root, and managing the local hypervisor
User Experience
The virt-manager application is running with normal user privileges. It thus has full integration with the local desktop session. They can configure PolicyKit to require no-password, or the user password (sudo style), or the root password (console-helper style) when attaching virt-manager to the local hypervisor.
Dependencies
This is an incremental step from the proposed feature on authentication:
Contingency Plan
Best case contingency:
- Simply use the libvirt SASL support with either Kerberos, or username/password for authetication
Worse case contingency:
- Continue to use console-helper as with Fedora 8 and earlier
Documentation
There is no special setup required for use of PolicyKit authentication with virt-manager/libvirt. If the desktop session supports PolicyKit it will automatically be enabled.
The libvirt website provides some notes on how to turn PolicyKit authentication on/off
Though it is enabled by default on Fedora and there is no particular need to turn it off.
Release Notes
It is now possible to run virt-manager as an unprivileged user and manage VMs running on the local machine. When starting virt-manager from the Applications menu select the 'Run unprivileged' option. At the time it attempts to connect to a local hypervisor it will automatically display a PolicyKit authentication dialog to obtain valid credentials. Once authentication it is possible to start/stop/configure virtual machines as needed. It is not yet possible to create new virtual machines when running unprivileged using PolicyKit auth. This ability will be added at a later date, once storage management capabilities are fully integrated with virt-manager.