Arch Linux

soiewq1324

Member

Registered: 2021-07-15

Posts: 2

Libvirt hooks in user session using intel-gvtg

Hello everyone,

I am following the arch wiki https://wiki.archlinux.org/title/Intel_GVT-g to set up Intel gvtg.
I am using libvirt user session and according to this section https://wiki.archlinux.org/title/Intel_ … _qemu_hook it says I can use libvirt qemu hooks in user session;

If you use libvirt user session, you need to tweak the script to use privilege elevation commands, such as pkexec(1) or a no-password sudo.

The script is;

/etc/libvirt/hooks/qemu

#!/bin/bash
GVT_PCI=<GVT_PCI>
GVT_GUID=<GVT_GUID>
MDEV_TYPE=<GVT_TYPE>
DOMAIN=<DOMAIN name>
if [ $# -ge 3 ]; then
    if [ $1 = "$DOMAIN" -a $2 = "prepare" -a $3 = "begin" ]; then
        echo "$GVT_GUID" > "/sys/bus/pci/devices/$GVT_PCI/mdev_supported_types/$MDEV_TYPE/create"
    elif [ $1 = "$DOMAIN" -a $2 = "release" -a $3 = "end" ]; then
        echo 1 > /sys/bus/pci/devices/$GVT_PCI/$GVT_GUID/remove
    fi
fi

I am trying to make this work using pkexec or no-password sudo but neither are working for me. Each time I start the vm it gives me the error;

/sys/bus/pci/devices/0000\:00\:02.0/mdev_supported_types/i915-GVTg_V5_4/create; Permission denied

With pkexec route, I followed https://wiki.archlinux.org/title/Polkit#Actions, and https://wiki.archlinux.org/title/Polkit … ic_actions

I created file

/usr/share/polkit-1/actions/org.freedesktop.policykit.pkexec.gvtg.policy

with the following:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/Po … config.dtd">
<policyconfig>

  <action id="org.freedesktop.policykit.pkexec.gvtg.hook">
    <description>qemu hook</description>
    <message>Authentication is required to run qemu hooks</message>
    <defaults>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/etc/libvirt/hooks/qemu</annotate>
  </action>
  <action id="org.freedesktop.policykit.pkexec.gvtg.create">
    <description>create gvtg</description>
    <message>Authentication is required to create gvtg</message>
    <defaults>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
    <annotate key="org.freedesktop.policykit.exec.path">/sys/bus/pci/devices/0000\:00\:02.0/mdev_supported_types/i915-GVTg_V5_4/create</annotate>
  </action>

</policyconfig>

then created a rule in

/etc/polkit-1/rules.d/49-nopasswd_limited.rules

with the following;

polkit.addRule(function(action, subject) {
    if ((action.id == "org.freedesktop.policykit.pkexec.gvtg.hook" ||
     action.id == "org.freedesktop.policykit.pkexec.gvtg.create") &&
        subject.isInGroup("libvirt")) {
        return polkit.Result.YES;
    }
});

I am not experienced with pkexec but that was what I could figure out from the guides.

with no-password sudo I created

/etc/sudoers.d/hooks

with following;

MYUSERNAME ALL=(ALL) NOPASSWD: /sys/bus/pci/devices/0000\:00\:02.0/mdev_supported_types/i915-GVTg_V5_4/create, /etc/libvirt/hooks/qemu

I tried both of them and still it gives me the same error of; /sys/bus/pci/devices/0000\:00\:02.0/mdev_supported_types/i915-GVTg_V5_4/create; Permission denied.

I don't know what they mean by "tweak the script"? do I need to put pkexec or sudo before each "echo" command, or at the start of the script?

Any input is appreciated.