diff options
| -rw-r--r-- | etc/polkit-1/rules.d/50-libvirt-wheel.rules | 13 | ||||
| -rw-r--r-- | meta/work.txt | 7 | ||||
| -rw-r--r-- | systemd-units/system.txt | 4 |
3 files changed, 24 insertions, 0 deletions
diff --git a/etc/polkit-1/rules.d/50-libvirt-wheel.rules b/etc/polkit-1/rules.d/50-libvirt-wheel.rules new file mode 100644 index 0000000..fac69bd --- /dev/null +++ b/etc/polkit-1/rules.d/50-libvirt-wheel.rules @@ -0,0 +1,13 @@ +// Allow members of the `wheel` group to manage libvirt (start/stop VMs, +// edit domains, attach devices) without a polkit password prompt. +// This single-user system already trusts wheel for administrative work +// via sudo-rs; libvirt's polkit gate is a separate path that does not +// honour sudoers, so a polkit rule is the idiomatic fix. +polkit.addRule(function (action, subject) { + if ( + action.id == "org.libvirt.unix.manage" && + subject.isInGroup("wheel") + ) { + return polkit.Result.YES; + } +}); diff --git a/meta/work.txt b/meta/work.txt index 8ea325e..c7b04c9 100644 --- a/meta/work.txt +++ b/meta/work.txt @@ -2,10 +2,17 @@ bear compiledb cuda cvise +dnsmasq +edk2-ovmf git-lfs intel-oneapi-dpcpp-cpp +libvirt llvm openmp python-pytest +qemu-desktop snx-rs +swtpm +virt-manager +virtiofsd xdot diff --git a/systemd-units/system.txt b/systemd-units/system.txt index 154ce4c..582a508 100644 --- a/systemd-units/system.txt +++ b/systemd-units/system.txt @@ -31,3 +31,7 @@ tor.service # --- nix (socket-activated builder daemon; the .service spawns on first # client connect, the .socket is what gets enabled) --- nix-daemon.socket + +# --- libvirt (socket-activated; daemons spawn on first virsh/virt-manager +# connect, the .socket is what gets enabled) --- +libvirtd.socket |