Ttyjfyk

I've installed Xen and libvirt on a CentOS 6.6 machine. All the tools (virt-manager, virsh etc) work perfectly as root (directly or via sudo) but I cannot allow another user to connect (failed to connect/DBus error).

My Configuration

I followed the procedure for allowing user access by creating a group and allowing this through polkit so I've:

groupadd virtadmin
usermod -a -G virtadmin davec

I also added myself to the KVM group (a suggestion found somewhere). The group is created and I'm in it as id outputs:

uid=500(davec) gid=500(davec) groups=500(davec),36(kvm),501(virtadmin)

To allow this in polkit I added the file /etc/polkit-1/localauthority/50-local.d/50-libvert-remote-access.pkla content:

Remote libvirt SSH access]
Identity:unix-group:virtadmin
Action:org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes

After this didn't work some googling told me that newer polkit versions (yum tells me I have 0.96) use a rules-based approach so I've also created a folder /etc/polkit-1/rules.d and added the file 80-libvirt-manage.rules containing:

polkit.addRule(function(action, subject) 
 if (action.id == "org.libvirt.unix.manage" && 
 subject.local && 
 subject.active && 
 subject.isInGroup("virtadmin")) 
 return polkit.Result.YES;
 
);

Now it may be that there is some problem with these but I can't find a log or any way it seems to test/verify/watch them.

So, according to the docs I've found, with that setup user davec should be able to access libvirt and run virsh or virt-manager.

The Error

[davec@polar rules.d]$ virsh -c xen:///
error: failed to connect to the hypervisor
error: internal error: DBus support not compiled into this binary

This is exactly the same error virt-manager gives when I try and connect.

Most of the online info about the DBus error refers to a problem with the hypervisor running/anyone connecting however root connects perfectly.

[davec@polar rules.d]$ sudo virsh -c xen:///
Welcome to virsh, the virtualization interactive terminal.

Exactly the same applies for SSH connections (which isn't surprising as SSH just tunnels I believe when you use a xen+ssh URI), root works non-root but group added user doesn't.

No doubt it's something simple and I'm being an idiot but... after a few days of Google not being my friend; any help truly appreciated.

The Answer

See below for c4f4t0r's correct (and accepted) answer which wins the bounty but just for info of anyone reading this it turns out to be nothing to do with polkit which doesn't appear to be configured/compiled/working with my libvirtd.

Was an in-built permissions (socket permissions) issue.

I think you can do in this way:

in /etc/libvirt/libvirtd.conf

unix_sock_group = "libvirt"
unix_sock_rw_perms = "0770"
auth_unix_rw = "none"

After that restart the libvirtd daemon

This worked for me:

unix_sock_group = "libvirt"
unix_sock_rw_perms = "0770"
unix_sock_dir = "/var/run/libvirt"
auth_unix_rw = "none"