19.7. Limiting what actions are available to virtual machine users

Procedure

1. Optional: Ensure your system’s polkit control policies related to libvirt are set up according to your preferences.

   1. Find all libvirt-related files in the /usr/share/polkit-1/actions/ and /usr/share/polkit-1/rules.d/ directories.

      # ls /usr/share/polkit-1/actions | grep libvirt
      # ls /usr/share/polkit-1/rules.d | grep libvirt

   2. Open the files and review the rule settings.

      For information about reading the syntax of polkit control policies, use man polkit.

   3. Modify the libvirt control policies. To do so:

      1. Create a new .rules file in the /etc/polkit-1/rules.d/ directory.

      2. Add your custom policies to this file, and save it.

         For further information and examples of libvirt control policies, see the libvirt upstream documentation.

2. Configure your VMs to use access policies determined by polkit.

   To do so, find all configuration files for virtualization drivers in the /etc/libvirt/ directory, and uncomment the access_drivers = [ "polkit" ] line in them.

   # find /etc/libvirt/ -name virt*d.conf -exec sed -i 's/#access_drivers = \[ "polkit" \]/access_drivers = \[ "polkit" \]/g' {} +

3. For each file that you modified in the previous step, restart the corresponding service.

   For example, if you have modified /etc/libvirt/virtqemud.conf, restart the virtqemud service.

   # systemctl try-restart virtqemud