diff options
author | xeji <xeji@cat3.de> | 2018-03-18 00:22:53 +0100 |
---|---|---|
committer | Uli Baum <xeji@cat3.de> | 2018-08-10 13:59:58 +0200 |
commit | 980505dc3b313aa92db69536d664875ac12ecb6a (patch) | |
tree | e61ca346557ec86b749fd2bbc1bdc8dbbfe590e4 /nixos/modules/virtualisation/libvirtd.nix | |
parent | 9c338630a9ff956e25abd550314c6d8fd1cfc4c1 (diff) | |
download | nixpkgs-980505dc3b313aa92db69536d664875ac12ecb6a.tar nixpkgs-980505dc3b313aa92db69536d664875ac12ecb6a.tar.gz nixpkgs-980505dc3b313aa92db69536d664875ac12ecb6a.tar.bz2 nixpkgs-980505dc3b313aa92db69536d664875ac12ecb6a.tar.lz nixpkgs-980505dc3b313aa92db69536d664875ac12ecb6a.tar.xz nixpkgs-980505dc3b313aa92db69536d664875ac12ecb6a.tar.zst nixpkgs-980505dc3b313aa92db69536d664875ac12ecb6a.zip |
nixos/libvirtd: add option to run qemu as non-root
New option virtualisation.libvirtd.qemuRunAsRoot (default: true). If false, qemu is run as non-privileged user qemu-libvirtd, reducing security risk
Diffstat (limited to 'nixos/modules/virtualisation/libvirtd.nix')
-rw-r--r-- | nixos/modules/virtualisation/libvirtd.nix | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix index 3d002bc2232..3e38662f5b0 100644 --- a/nixos/modules/virtualisation/libvirtd.nix +++ b/nixos/modules/virtualisation/libvirtd.nix @@ -17,6 +17,10 @@ let ${optionalString cfg.qemuOvmf '' nvram = ["/run/libvirt/nix-ovmf/OVMF_CODE.fd:/run/libvirt/nix-ovmf/OVMF_VARS.fd"] ''} + ${optionalString (!cfg.qemuRunAsRoot) '' + user = "qemu-libvirtd" + group = "qemu-libvirtd" + ''} ${cfg.qemuVerbatimConfig} ''; @@ -56,6 +60,18 @@ in { ''; }; + virtualisation.libvirtd.qemuRunAsRoot = mkOption { + type = types.bool; + default = true; + description = '' + If true, libvirtd runs qemu as root. + If false, libvirtd runs qemu as unprivileged user qemu-libvirtd. + Changing this option to false may cause file permission issues + for existing guests. To fix these, manually change ownership + of affected files in /var/lib/libvirt/qemu to qemu-libvirtd. + ''; + }; + virtualisation.libvirtd.qemuVerbatimConfig = mkOption { type = types.lines; default = '' @@ -110,6 +126,14 @@ in { users.groups.libvirtd.gid = config.ids.gids.libvirtd; + # libvirtd runs qemu as this user and group by default + users.extraGroups.qemu-libvirtd.gid = config.ids.gids.qemu-libvirtd; + users.extraUsers.qemu-libvirtd = { + uid = config.ids.uids.qemu-libvirtd; + isNormalUser = false; + group = "qemu-libvirtd"; + }; + systemd.packages = [ pkgs.libvirt ]; systemd.services.libvirtd = { |