Hello,

I've been unable to use libvirt for a while and I haven't yet found a
workaround or a fix..

This started happening the last time I ran package upgrades. However, since I
don't run them very often I'm not sure with which versions of packages it
started happening. If it seems relevant to do so, I can test rolling back to
older packages to figure out when things started to break down.

I've been using libvirt with qemu-kvm for a while.

my user is part of the libvirt and kvm groups so I should have access to the
local unix sockets. however when I try and connect to libvirt on localhost
(either with vagrant-libvirt or with virt-manager) I get an error message that
also appears in the service's log as:

Apr 16 17:51:47 meevyl libvirtd[544743]: error from service: CheckAuthorization: Action org.libvirt.unix.manage is not registered
Apr 16 17:51:47 meevyl libvirtd[544743]: End of file while reading data: Input/output error


From what I could vaguely understand, the first line seems to be related to
polkit but I don't quite understand how this thing is supposed to be working.


I do have polkit installed and runing:

$ dpkg -l | grep polkit
ii  gir1.2-polkit-1.0                       0.105-26                               amd64        GObject introspection data for PolicyKit
ii  libpolkit-agent-1-0:amd64               0.105-26                               amd64        PolicyKit Authentication Agent API
ii  libpolkit-gobject-1-0:amd64             0.105-26                               amd64        PolicyKit Authorization API
$ ps aux|grep polkit
root      544473  0.0  0.0 235204 10120 ?        Ssl  17:49   0:00 /usr/lib/policykit-1/polkitd --no-debug
gabster   545750  0.0  0.0   8744   844 pts/8    S+   18:29   0:00 grep --color=auto polkit

Hi,

Is that qemu:///system ?

You don't show the polkitd (package policykit-1) version but if that's
0.105 as well can you check if things like

   pkexec /bin/ls

work and and check if
/var/lib/polkit-1/localauthority/10-vendor.d/60-libvirt.pkla is present
and there's no other libvirt related policies e.g. in /etc/polkit-1?
 -- Guido

Hi Guido,

thanks for your quick feedback! much appreciated.

and vagrant shows it this way (also confirming that it's connecting to
qemu:///system:

Error while connecting to libvirt: Error making a connection to libvirt
URI qemu:///system?no_verify=1&keyfile=/home/gabster/.ssh/id_rsa:
Call to virConnectOpen failed: error from service: CheckAuthorization:
Action org.libvirt.unix.manage is not registered

oh, right I missed this out in the original report:

$ dpkg -l | grep policykit
ii  policykit-1                             0.105-26
           amd64        framework for managing administrative policies
and privileges
ii  policykit-1-gnome                       0.105-7
           amd64        authentication agent for PolicyKit

this asks me for my password, and then shows this output (it's not the
contents of the current directory so I'm not sure what it's listing
exactly):

$ pkexec /bin/ls
snap

I get file not found for the above.

nothing that seems relevant to libvirt in both directories:

$ sudo tree /var/lib/polkit-1/localauthority/
/var/lib/polkit-1/localauthority/
├── 10-vendor.d
│   ├── fwupd.pkla
│   ├── geoclue-2.0.pkla
│   ├── gnome-control-center.pkla
│   ├── org.freedesktop.Flatpak.pkla
│   ├── org.freedesktop.NetworkManager.pkla
│   ├── org.freedesktop.packagekit.pkla
│   └── systemd-networkd.pkla
├── 20-org.d
├── 30-site.d
├── 50-local.d
└── 90-mandatory.d

5 directories, 7 files

$ sudo tree /etc/polkit-1/
/etc/polkit-1/
├── localauthority
│   ├── 10-vendor.d
│   ├── 20-org.d
│   ├── 30-site.d
│   ├── 50-local.d
│   └── 90-mandatory.d
├── localauthority.conf.d
│   ├── 50-localauthority.conf
│   └── 51-debian-sudo.conf
└── rules.d
    ├── 40-debian-sudo.rules
    └── 50-default.rules

8 directories, 4 files

since I use etckeeper, I've checked the history for /etc/polkit-1/ and
there was never a file with "libvirt" in its name in there.


oh! but I just searched on codesearch.d.n and found out that the polkit
file should be installed there by libvirt-daemon-system  and for some
reason this package was in state "rc" on my system.

I with version 6.0.0-6 of it with "apt install libvirt-daemon-system"
and now it's present on my system!

.... and I can connect to qemu:///system again!

I've also had to manually start the virtlogd.socket unit. but now with
those two details fixed I can manage VMs again on my laptop.


I'm not sure why libvirt-daemon-system had been left semi-removed on the
system though .. according to my dpkg log it was left removed during the
upgrade from 5.6.0-3 to 6.0.0-5

.. oh well I guess it's all fine for now. thanks, I was able to figure
it out thanks to your pointers!

I ran into this same issue on a buster system, with additional
buster-backports packages installed. After digging through it appears
that during a recent update the libvirt-daemon-system package was
uninstalled without me noticing. Reinstalling the package also resolved
the issue for me.

Joel

Hi,
Because of an other problem with a vagrant box and debian buster
i tried to reproduce that issue on a newly installed debian bullseye.

Now i run into this issue.

sudo debsums --config | grep -v OK
/etc/sudoers        FAILED

id
uid=1004(beschat) gid=1004(beschat)
Gruppen=1004(beschat),1005(libvirtd),64055(libvirt-qemu)


$ echo $VAGRANT_DEFAULT_PROVIDER
libvirt


Bringing machine 'default' up with 'libvirt' provider...
Error while connecting to Libvirt: Error making a connection to libvirt
URI qemu:///system?no_verify=1&keyfile=/home/beschat/.ssh/id_rsa:
Call to virConnectOpen failed: authentication unavailable: no polkit
agent available to authenticate action 'org.libvirt.unix.manage'


  dpkg -l | grep polkit
ii  gir1.2-polkit-1.0                             0.105-29
               amd64        GObject introspection data for PolicyKit
ii  libpolkit-agent-1-0:amd64                     0.105-29
               amd64        PolicyKit Authentication Agent API
ii  libpolkit-gobject-1-0:amd64                   0.105-29
               amd64        PolicyKit Authorization API
ii  libpolkit-qt5-1-1:amd64                       0.113.0-1
               amd64        PolicyKit-qt5-1 library


sudo cat /var/lib/polkit-1/localauthority/10-vendor.d/60-libvirt.pkla
[Allow group libvirt management permissions]
Identity=unix-group:libvirt
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes

Hi,
group, after:


sudo usermod -a -G libvirt beschat

the box starts, now i ran into this:

$ vagrant up
Bringing machine 'default' up with 'libvirt' provider...
==> default: Checking if box 'debian/testing64' version '20210124.1' is
up to date...
==> default: Starting domain.
There was an error talking to Libvirt. The error message is shown
below:

Call to virDomainCreateWithFlags failed: can't connect to virtlogd:
Socket-Erstellung zu '/r


But this seems to be another issue ...