libvirt tries to read /etc/sasl/libvirt.conf not /etc/sasl2/libvirt.conf despite docs

[Craig Ringer]

Description: Ubuntu 9.10
Release: 9.10
Codename: karmic

libvirtd (libvirt) 0.7.0

/etc/libvirt/libvirtd.conf contains the comment:

# - sasl: use SASL infrastructure. The actual auth scheme is then
# controlled from /etc/sasl2/libvirt.conf. For the TCP
# socket only GSSAPI & DIGEST-MD5 mechanisms will be used.
# For non-TCP or TLS sockets, any scheme is allowed.
#

yet strace'ing libvirtd startup reveals that it's actually looking for /etc/sasl/libvirt.conf, which is why sasl authentication is not working . It should be reading /etc/sasl2/libvirt.conf.

Once /etc/sasl2 is symlinked to /etc/sasl, it still fails, but that's another bug.

[Jamie Strandboge (jdstrand)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. The issue that you reported is one that should be reproducible with the live environment of the Desktop CD of the development release - Lucid Lynx. It would help us greatly if you could test with it so we can work on getting it fixed in the next release of Ubuntu. You can find out more about the development release at http://www.ubuntu.com/testing/ . Thanks again and we appreciate your help.

[Peter Selby (niten)]

Description: Ubuntu 10.10
Release: 10.10
Codename: maverick

libvirtd (libvirt) 0.8.3

This bug still exists in 10.10 and 0.8.3. All available docs that I've seen refer to /etc/sasl2/libvirt.conf, but strace still reports that only /etc/sasl/libvirt.conf (and /usr/lib/sasl2/libvirt.conf) are actually accessed.

Linking /etc/sasl2 to /etc/sasl solved the problem for me, and I've got Kerberos working with libvirt now.

[Neil Wilson (neil-aldur)]

The cyrus-sasl package in Debian/Ubuntu uses '/etc/sasl' as the standard directory in which to find the application configurations.

The fault here with the libvirt package is that it is putting the example sasl configuration in /etc/sasl2 which is wrong for Debian/Ubuntu.

[Neil Wilson (neil-aldur)]

Note that apparmor will need adjusting to allow qemu to access /etc/sasl

[Neil Wilson (neil-aldur)]

/etc/apparmor.d/abstractions/libvirt-qemu needs

/etc/sasl/qemu.conf r,

adding to it.