Client access control

Libvirt's client access control framework allows administrators to setup fine grained permission rules across client users, managed objects and API operations. This allows client connections to be locked down to a minimal set of privileges.

Access control introduction

In a default configuration, the libvirtd daemon has three levels of access control. All connections start off in an unauthenticated state, where the only API operations allowed are those required to complete authentication. After successful authentication, a connection either has full, unrestricted access to all libvirt API calls, or is locked down to only "read only" operations, according to what socket a client connection originated on.

The access control framework allows authenticated connections to have fine grained permission rules to be defined by the administrator. Every API call in libvirt has a set of permissions that will be validated against the object being used. For example, the virDomainSetSchedulerParametersFlags method will check whether the client user has the write permission on the domain object instance passed in as a parameter. Further permissions will also be checked if certain flags are set in the API call. In addition to checks on the object passed in to an API call, some methods will filter their results. For example the virConnectListAllDomains method will check the search_domains on the connect object, but will also filter the returned domain objects to only those on which the client user has the getattr permission.

Access control drivers

The access control framework is designed as a pluggable system to enable future integration with arbitrary access control technologies. By default, the none driver is used, which does no access control checks at all. At this time, libvirt ships with support for using polkit as a real access control driver. To learn how to use the polkit access driver consult the configuration docs.

The access driver is configured in the libvirtd.conf configuration file, using the access_drivers parameter. This parameter accepts an array of access control driver names. If more than one access driver is requested, then all must succeed in order for access to be granted. To enable 'polkit' as the driver:

# augtool -s set '/files/etc/libvirt/libvirtd.conf/access_drivers[1]' polkit
    

And to reset back to the default (no-op) driver

# augtool -s rm /files/etc/libvirt/libvirtd.conf/access_drivers
    

Note: changes to libvirtd.conf require that the libvirtd daemon be restarted.

Objects and permissions

Libvirt applies access control to all the main object types in its API. Each object type, in turn, has a set of permissions defined. To determine what permissions are checked for specific API call, consult the API reference manual documentation for the API in question.

virConnectPtr

PermissionDescription
detect-storage-poolsDetect storage pools
getattrAccess connection
interface-transactionInterface transactions
pm-controlUse host power management
readRead host
search-domainsList domains
search-interfacesList interfaces
search-networksList networks
search-node-devicesList node devices
search-nwfiltersList network filters
search-secretsList secrets
search-storage-poolsList storage pools
writeWrite host

virDomainPtr

PermissionDescription
block-readRead domain block
block-writeWrite domain block
core-dumpDump domain
deleteDelete domain
fs-trimTrim domain filesystems
getattrAccess domain
hibernateHibernate domain
init-controlDomain init control
inject-nmiInject domain NMI
mem-readRead domain memory
migrateMigrate domain
open-deviceOpen domain device
open-graphicsOpen domain graphics
open-namespaceOpen domain namespace
pm-controlUse domain power management
readRead domain
read-secureRead secure domain
resetReset domain
saveSave domain
screenshotTake domain screenshot
send-inputSend domain input
send-signalSend domain signal
snapshotSnapshot domain
startStart domain
stopStop domain
suspendSuspend domain
writeWrite domain

virInterfacePtr

PermissionDescription
deleteDelete interface
getattrAccess interface
readRead interface
saveSave interface
startStart interface
stopStop interface
writeWrite interface

virNetworkPtr

PermissionDescription
deleteDelete network
getattrAccess network
readRead network
saveSave network
startStart network
stopStop network
writeWrite network

virNodeDevicePtr

PermissionDescription
detachDetach node device
getattrAccess node device
readRead node device
startStart node device
stopStop node device
writeWrite node device

virNWFilterPtr

PermissionDescription
deleteDelete network filter
getattrAccess network filter
readRead network filter
saveSave network filter
writeWrite network filter

virSecretPtr

PermissionDescription
deleteDelete secret
getattrAccess secret
readRead secret
read-secureRead secure secret
saveSave secret
writeWrite secret

virStoragePoolPtr

PermissionDescription
deleteDelete storage pool
formatFormat storage pool
getattrAccess storage pool
readRead storage pool
refreshRefresh storage pool
saveSave storage pool
search-storage-volsList storage pool volumes
startStart storage pool
stopStop storage pool
writeWrite storage pool

virStorageVolPtr

PermissionDescription
createCreate storage volume
data-readRead storage volume data
data-writeWrite storage volume data
deleteDelete storage volume
formatFormat storage volume
getattrAccess storage volume
readRead storage volume
resizeResize storage volume