3

Been trying to resolve an issue I found by having our Nagios installation use a plugin for KVM, check_kvm, I found. I think my problem boils down to a permissions issue with the nagios/nrpe user. After installing nrpe and plugins, I do not have any issues with other standard plugins like check_disk or check_load, etc. Basically, the kvm plugin is using virsh to check status, so I enabled login for nrpe (also tried the nagios user, but it appears the service is running under nrpe user) and tried the following:

[root@vhost3 ~]# su nrpe
sh-4.2$ virsh list --all
error: failed to connect to the hypervisor
error: no valid connection
error: Cannot create user runtime directory '/run/user/0/libvirt': Permission denied

But no problem with this command as root of course and the plugin executes well when trying locally:

[root@vhost3 ~]# virsh list --all
 Id    Name                           State
----------------------------------------------------
 2     www                            running
[root@vhost3 ~]# /usr/lib64/nagios/plugins/check_kvm
hosts:1 OK:1 WARN:0 CRIT:0 - www:running

I've tried adding the nrpe user, and nagios for that matter, to the kvm and qemu groups, I don't find a libvirtd group. One weird thing is I get a different error on another machine, perhaps I did something different on that server, but I get this instead:

[root@vhost1 ~]# su nrpe
sh-4.2$ virsh list --all
error: failed to connect to the hypervisor
error: no valid connection
error: Failed to connect socket to '/run/user/0/libvirt/libvirt-sock': Permission denied

Other weird thing about the error above, that /run/user/0/libvirt directory does not exist. On this CentOS7 host, the correct directory is /var/run/libvirt where the libvirt-sock exists. Can someone suggest what my problem is?

rwfitzy
  • 233
  • 5
  • 16

2 Answers2

3

By default non-root users cannot access libvirtd directly, unless explicitly granted authorization.

I've done this using PolicyKit:

# cat /etc/polkit-1/rules.d/50-org.libvirt.unix.manage.rules
polkit.addRule(function(action, subject) {
        if (action.id == "org.libvirt.unix.manage" &&
            subject.user == "nrpe") {
                return polkit.Result.YES;
                polkit.log("action=" + action);
                polkit.log("subject=" + subject);
        }
});

This will let user nrpe do whatever they want to do with libvirtd without requiring a password.

Second, non-root users need to specify the connection URL explicitly in order to access the system libvirtd.

virsh --connect qemu:///system list --all
Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
1

Old topic, but I had the same problem today and I think the answer above is not the simplest solution:

ssh root@node
[root@node ~]# su kevin
[kevin@node root]$ echo $XDG_RUNTIME_DIR
/run/user/0
[kevin@node root]$ virsh capabilities
error: failed to connect to the hypervisor
error: Cannot create user runtime directory '/run/user/0/libvirt': Permission denied

--> doesn't work

ssh kevin@node
[kevin@perf28 ~]$ echo $XDG_RUNTIME_DIR
/run/user/1001
[kevin@perf28 ~]$ virsh capabilities
<capabilities>
...
</capabilities>

--> works!

so the issue is that su (from the root account) doesn't set XDG_RUNTIME_DIR, so either re-login with the user, or manually set XDG_RUNTIME_DIR.

Kevin
  • 113
  • 5