user not added to libvirtd group with iso trusty 'virtual machine host' installation method

[Ryan Beisner]

user not added to libvirtd group with iso trusty 'virtual machine host' installation method

##### Scenario #####
* User installs Trusty server from ISO (daily build 20140407 in this case).
* User selects Virtual Machine Host from the software selection menu, otherwise, installation defaults are kept.
* After installation completes, user execs: apt-get install virt-manager
* User reboots the box and/or logs off and logs back in
* User can't connect to libvirtd with virt-manager because of group membership.
* Take note that this issues does not appear to surface when installing libvirt, KVM, et al, via apt-get. It appears to affect the ISO 'Virtual Machine Host' installation method only.
* I've also confirmed that the apt-get installation method does indeed add the user to the libvirtd group on the same base ISO release.
.

----- Error Detail -----
virt-manager 'unable to connect to libvirt.'
Verify that:
 - The 'libvirt-bin' package is installed
 - The 'libvirtd' daemon has been started
 - You are a member of the libvirtd group

line 105, in openAuth
    if ret is None:raise libvirtError('virConnectOpenAuth() failed')
libvirtError: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied

rbeisner@130-5:~$ groups
rbeisner adm cdrom sudo dip plugdev lpadmin sambashare
* Take note, no libvirtd membership.

rbeisner@130-5:~$ uname -a
Linux 130-5 3.13.0-23-generic #45-Ubuntu SMP Fri Apr 4 06:58:38 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

rbeisner@130-5:~$ dpkg -l | egrep 'libvirt|virt-manager'
ii libvirt-bin 1.2.2-0ubuntu10 amd64 programs for the libvirt library
ii libvirt0 1.2.2-0ubuntu10 amd64 library for interfacing with different virtualization systems
ii python-libvirt 1.2.2-0ubuntu1 amd64 libvirt Python bindings
ii virt-manager 0.9.5-1ubuntu3 all desktop application for managing virtual machines
.

##### Workaround #####
$ sudo usermod -a -G libvirtd yourusername
$ groups
yourusername adm cdrom sudo dip plugdev libvirtd lpadmin sambashare

* Log out, log in, launch virt-manager, it connects to libvirtd successfully.
.

##### Expected Results #####
* Users who are members of the sudo group should also be members of the libvirtd group, and should be able to manage libvirt using virt-manager. In an older build of Trusty daily ISO, it did behave as expected, as shown below:

rbeisner@bcu:~$ groups
rbeisner adm cdrom sudo dip plugdev lpadmin libvirtd sambashare

rbeisner@bcu:~$ uname -a
Linux bcu 3.13.0-22-generic #44-Ubuntu SMP Wed Apr 2 20:05:40 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
rbeisner@bcu:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu Trusty Tahr (development branch)
Release: 14.04
Codename: trusty

rbeisner@bcu:~$ dpkg -l | egrep 'libvirt|virt-manager'
ii libvirt-bin 1.2.2-0ubuntu10 amd64 programs for the libvirt library
ii libvirt0 1.2.2-0ubuntu10 amd64 library for interfacing with different virtualization systems
ii python-libvirt 1.2.2-0ubuntu1 amd64 libvirt Python bindings
ii virt-manager 0.9.5-1ubuntu3 all desktop application for managing virtual machines

* virt-manager gui can connect to libvirtd without adjusting group membership.

[Ryan Beisner (1chb1n)]

Reference - possibly related bug 1124127
'sudo group users not added to libvirtd group on install'
https://bugs.launchpad.net/ubuntu/quantal/+source/libvirt/+bug/1124127

[Ubuntu QA Website (ubuntuqa)]

This bug has been reported on the Ubuntu ISO testing tracker.

A list of all reports related to this bug can be found here:
http://iso.qa.ubuntu.com/qatracker/reports/bugs/1304008

[Serge Hallyn (serge-hallyn)]

apt-get install libvirt-bin does the right thing. using tasksel at install time does not. Does this mean libvirt needs to pre-depends on sudo to ensure that sudo adds users to sudo group first?

[Ryan Beisner (1chb1n)]

* FYI, just usual post-install stuff in /var/log/apt/* ... selecting, preparing, unpacking, setting up, etc. No other postinst trails in /var/log/

* Another workaround/fix which creates groups as they need to be:
$ sudo apt-get --reinstall install libvirt-bin

rbeisner@130-5:~$ groups
rbeisner adm cdrom sudo dip plugdev libvirtd lpadmin sambashare

rbeisner@130-5:/var/log/apt$ egrep 'rbeisner|libvirt' /etc/group
adm:x:4:syslog,rbeisner
cdrom:x:24:rbeisner
sudo:x:27:rbeisner
dip:x:30:rbeisner
plugdev:x:46:rbeisner
libvirtd:x:111:rbeisner
rbeisner:x:1000:
lpadmin:x:112:rbeisner
sambashare:x:113:rbeisner
.

* Interesting that a reinstall of libvirt-bin creates the group membership as we had originally expected. There may be a logic error in the order of events during install via iso?

[Serge Hallyn (serge-hallyn)]

> * Interesting that a reinstall of libvirt-bin creates the group
> membership as we had originally expected. There may be a logic error in
> the order of events during install via iso?

This is why I'm suggesting Pre-Depends: sudo for libvirt-bin. I
think that libvirt-bin.postinst is being run before the newly
created user has been added to the sudo group.

Note that though I marked this high priority, it has been pointed
out to me that tasksel is deemed somewhat obsolete so perhaps the
prio should be lowered.

[Serge Hallyn (serge-hallyn)]

After talking to stgraber on irc, we can address this in one of two ways:

We can have user-setup-apply (in the user-setup package) handle adding the default user to libvirtd if the libvirtd group exists.

Or we can mark in release notes that users should add libvirtd to passwd/user-default-groups (using preseed).

[Serge Hallyn (serge-hallyn)]

Untested proposed debdiff against user-setup to solve this bug for libvirt.

[Launchpad Janitor (janitor)]

This bug was fixed in the package user-setup - 1.48ubuntu2

---------------
user-setup (1.48ubuntu2) trusty; urgency=medium

  * Add the initial user to the libvirtd group (LP: #1304008).
  * Add maas to reserved-usernames (LP: #1069684).
 -- Colin Watson <email address hidden> Tue, 08 Apr 2014 15:13:12 +0100

[Ryan Beisner (1chb1n)]

Confirmed fix on Trusty server ISO 2014-APR-09.

Initial user is now a member of the libvirtd group when installing via 'virtual machine host' package selection.

Thank you all!