diff options
| -rw-r--r-- | dot_config/libvirt/libvirt.conf | 1 | ||||
| -rw-r--r-- | etc/nftables.conf | 16 | ||||
| -rw-r--r-- | etc/polkit-1/rules.d/50-libvirt-wheel.rules | 13 | ||||
| -rw-r--r-- | systemd-units/system.txt | 4 |
4 files changed, 0 insertions, 34 deletions
diff --git a/dot_config/libvirt/libvirt.conf b/dot_config/libvirt/libvirt.conf deleted file mode 100644 index deb583b..0000000 --- a/dot_config/libvirt/libvirt.conf +++ /dev/null @@ -1 +0,0 @@ -uri_default = "qemu:///system" diff --git a/etc/nftables.conf b/etc/nftables.conf index cb6e4d7..fc2d1e7 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -15,13 +15,6 @@ table inet filter { meta l4proto { icmp, icmpv6 } accept comment "allow icmp" meta pkttype multicast udp dport 5353 accept comment "allow mDNS discovery" - # libvirt's NAT bridge: let guests reach the host's dnsmasq for DHCP+DNS. - # libvirt manages its own forward/NAT chains but does NOT touch the input - # chain, so without this rule guests get no IP (DHCP packets are dropped - # before dnsmasq sees them). - iifname "virbr0" udp dport { 53, 67 } accept comment "libvirt: DHCP+DNS from guests" - iifname "virbr0" tcp dport 53 accept comment "libvirt: DNS over TCP from guests" - pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited counter } @@ -29,14 +22,5 @@ table inet filter { type filter hook forward priority filter policy drop - # libvirt's NAT bridge: permit guest traffic to be forwarded. libvirt's - # own table accepts these explicitly at the same hook+priority, but with - # nftables a packet must be accepted by ALL chains at that priority, so - # our policy=drop would otherwise block all guest egress and return - # traffic. Mirror libvirt's accepts here for the default NAT bridge. - # Use iifname/oifname (string match) instead of iif/oif so the rules - # load before libvirtd has created virbr0 at boot. - iifname "virbr0" accept comment "libvirt: guest egress" - oifname "virbr0" ct state established,related accept comment "libvirt: guest return" } } diff --git a/etc/polkit-1/rules.d/50-libvirt-wheel.rules b/etc/polkit-1/rules.d/50-libvirt-wheel.rules deleted file mode 100644 index fac69bd..0000000 --- a/etc/polkit-1/rules.d/50-libvirt-wheel.rules +++ /dev/null @@ -1,13 +0,0 @@ -// Allow members of the `wheel` group to manage libvirt (start/stop VMs, -// edit domains, attach devices) without a polkit password prompt. -// This single-user system already trusts wheel for administrative work -// via sudo-rs; libvirt's polkit gate is a separate path that does not -// honour sudoers, so a polkit rule is the idiomatic fix. -polkit.addRule(function (action, subject) { - if ( - action.id == "org.libvirt.unix.manage" && - subject.isInGroup("wheel") - ) { - return polkit.Result.YES; - } -}); diff --git a/systemd-units/system.txt b/systemd-units/system.txt index bb24e0b..1c31da3 100644 --- a/systemd-units/system.txt +++ b/systemd-units/system.txt @@ -32,9 +32,5 @@ tor.service # client connect, the .socket is what gets enabled) --- nix-daemon.socket -# --- libvirt (socket-activated; daemons spawn on first virsh/virt-manager -# connect, the .socket is what gets enabled) --- -libvirtd.socket - # --- file sync (system template; binary comes from the user's nix profile) --- syncthing@sommerfeld.service |