[Pkg-libvirt-maintainers] Bug#1042429: libvirt-daemon-system: VM running but virt-manager not connecting

[Andrea Bolognani]

On Fri, Jul 28, 2023 at 09:21:42AM +0200, Andreas Guenther wrote:
> After starting, the Virt-manager window remains empty and
> instead shows the message "QEMU/KVM - Not Connected".
> 
> * What led up to the situation?
> 
>   System upgrade from Debian 11 to Debian 12
> 
> * What exactly did you do (or not do) that was effective (or
>   ineffective)?
> 
>   Copy the file
>   /var/lib/polkit-1/localauthority/10-vendor.d/60-libvirt.pkla
>   from the package of the same name in Buster to the same place
>   on the Bookworm installation. Restart libvirtd.
> 
> * What was the outcome of this action?
> 
>   The virt-manager works as usual again

This is surprising, as the version of polkit that comes with Debian
12 is capable of using JavaScript rules.

For libvirt that's /usr/share/polkit-1/rules.d/60-libvirt.rules,
which implements the same logic as the pkla rules did in previous
releases, namely that members of the "libvirt" group should be
allowed to manage the system instance of libvirtd.

I have tried just now with a fresh installation of Debian 12 and
everything seems to work as intended.

> -- System Information:
> Debian Release: 12.1
>   APT prefers stable-updates
>   APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
> Architecture: amd64 (x86_64)
> 
> Kernel: Linux 5.10.0-8-amd64 (SMP w/8 CPU threads)

This doesn't look right for Debian 12, you should be running 6.1.0.

Is it possible that you haven't rebooted the machine after performing
the upgrade? The new version of polkit, which can read the JavaScript
rules, will only take over at that point, so if you haven't rebooted
yet it would make sense that the pkla rules disappearing would cause
the currently running version of polkit to no longer grant you access
to libvirt.

> Versions of packages libvirt-daemon-system depends on:
> ii  polkitd                         122-3

This version of polkit should be perfectly able to process the
JavaScript version of the rules.

-- 
Andrea Bolognani <eof at kiyuko.org>
Resistance is futile, you will be garbage collected.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-libvirt-maintainers/attachments/20230819/82b9c0c2/attachment.sig>