If there’s a scenario where we want to interface with libvirt directly and we are in need resizing the storage volumes for our VMs this post provides quick pointers for achieving the same.
By default QEMU has the following user permissions set for the storage images: libvirt-qemu:kvm user:userGroup.
Linux best user & user groups practices
In linux it’s best practice to have separate users than the regular same user for running different services as it helps reducing the impact in case of a compromise. And, never should you run a service as root. Because, if you chose to do so, and if with some attack the service gets compromised in a way where the attacker has access to the user who executed the service, having root as that choice for executing the service with is the worst possible choice we can go for — attacker will have full privileges in that scenario.
The need for user groups in linux
Ideally, groups acts as the interface to provide abilities to users in the group and to separate out the security concerns at the same time. Usually, a certain group is provided the capabilities for different API’s of a software unit and when a new user joins this group it inherits the power of the group.
Step 1 — Setup the proper way for user & user groups for libvirt
Have a different user (say $user) for managing your VMs if you have high security needs for the services running on your system. Add this $user to the libvirt group. libvirt group has access to run VM related actions as non-root.
$ sudo usermod -aG libvirt <DEDICATED_USER_FOR_VMs>Step 2 — Configure qemu to operate libvirt with the custom user/userGroup
Tell QEMU to run libvirt operations for managing the VMs with the above user with the newly added libvirt usergroup capabilities
$ sudo vim /etc/libvirt/qemu.conf
...
user="<DEDICATED_USER_FOR_VMS>"
group="libvirt"
...Step 3 (Optional) — Correct the permissions for the storage images
If required make the above $user as the owner for the storage images.
$ sudo chown <DEDICATED_USER_FOR_VMS>:libvirt <STORAGE_IMAGE_FILE1> <STORAGE_IMAGE_FILE2> ... Step 4 — Resize the image files
sudo qemu-img resize <IMAGE_FILE> +50GStep 5 — Reboot system or restart libvirt daemon
Finally reboot your system or restart the libvirt daemon
$ rebootOR
$ sudo systemctl restart libvirtdAdditional Tips
If you want to autostart the VMs on reboot, checkout this post on how to autostart the VMs on host system boot.