Host is missing polkit definitions for libvirt

[Piotr Parczewski]

Libvirt deamon from nova_libvirt container consults polkit service running on the host. Since libvirt daemon is installed in container's image, the following files are to be found in the image but not on the host:

/usr/share/polkit-1/actions/org.libvirt.api.policy
/usr/share/polkit-1/actions/org.libvirt.unix.policy
/usr/share/polkit-1/rules.d/50-libvirt.rules

This causes polkit service to be unaware of any libvirt related actions and policies, which makes it difficult/impossible to enable a secure access to libvirt's socket for a third-party.

[Piotr Parczewski (parczewski)]

Victoria release, CentOS source installation.

[Radosław Piliszek (yoctozepto)]

Considering the fragility of this component (libvirtd), should we actually focus on working with the host one instead of trying to containerise?

[Piotr Parczewski (parczewski)]

That probably makes sense the most - I did not consider creating polkit inside a container. One obvious workaround / feature could be allowing users for disabling polkit support in libvirt and control socket access using regular filesystem permissions.

Also, I did not check the behaviour on Ubuntu yet.

[Radosław Piliszek (yoctozepto)]

Last time I played with libvirtd to get Debian Bullseye rolling, I had some crazy ideas. Sharing one: https://review.opendev.org/c/openstack/kolla-ansible/+/794262
Perhaps that would help as well. Though no idea if it breaks or kills any kitties. Let's see.

[Radosław Piliszek (yoctozepto)]

It seems to be generally passing, waiting for all results.
So, isolating containerised libvirtd from host's systemd and dbus (and thus polkit), seems to still pass our tests. Does it solve your issue?

[Pierre Riteau (priteau)]

We can also disable polkit entirely for the read-only socket:

/etc/kolla/nova-libvirt/libvirtd.conf:
auth_unix_ro = "none"

[Pierre Riteau (priteau)]

We already have this configuration option enabled by a flag:

{% if enable_neutron_mlnx | bool %}
# Enable read-only access to libvirt socket
auth_unix_ro = "none"
{% endif %}