KVM kernel module permission denied on foreign distro

KVM kernel module permission denied on foreign distro

[Giovanni Biscuolo]

[-- Attachment #1: Type: text/plain, Size: 3008 bytes --]

Hi!

I'm trying to create my first VM via "guix system vm <config.scm>" but
it fails with this error:

--8<---------------cut here---------------start------------->8---
creating qcow2 image of 70.00 MiB...
Formatting '/gnu/store/4mz1qqv7h5g5885q1aq0izlmy01knf1g-qemu-image', fmt=qcow2 size=73400320 cluster_size=65536 lazy_refcounts=off refcount_bits=16
Could not access KVM kernel module: Permission denied
qemu-system-x86_64: failed to initialize KVM: Permission denied
Backtrace:
           2 (primitive-load "/gnu/store/hyaagi7v0qda56rivy893px3rvz?")
In ./gnu/build/vm.scm:
    146:2  1 (load-in-linux-vm _ #:output _ #:qemu _ #:memory-size _ ?)
In ./guix/build/utils.scm:
    616:6  0 (invoke _ . _)

./guix/build/utils.scm:616:6: In procedure invoke:
Throw to key `srfi-34' with args `(#<condition &invoke-error [program: "qemu-system-x86_64" arguments: ("-nographic" "-no-reboot" "-m" "256" "-object" "rng-random,filename=/dev/urandom,id=guixsd-vm-rng" "-device" "virtio-rng-pci,rng=guixsd-vm-rng" "-virtfs" "local,id=store_dev,path=/gnu/store,security_model=none,mount_tag=store" "-virtfs" "local,id=xchg_dev,path=xchg,security_model=none,mount_tag=xchg" "-virtfs" "local,id=tmp_dev,path=tmp,security_model=none,mount_tag=tmp" "-kernel" "/gnu/store/y5aiijqiqna1y8ypn6c0jp367813xxnc-linux-libre-4.20.3/bzImage" "-initrd" "/gnu/store/xdpsk95srxg6dvvy8pj3njxwk02pphpl-raw-initrd/initrd.cpio.gz" "-device" "virtio-blk,drive=myhd" "-drive" "if=none,file=/gnu/store/4mz1qqv7h5g5885q1aq0izlmy01knf1g-qemu-image,format=qcow2,id=myhd" "-enable-kvm" "-append" "panic=1 --load=/gnu/store/wxrmx10lmyrif8136gndxhr1msnhkrf1-linux-vm-loader console=ttyS0" "-net" "nic,model=virtio") exit-status: 1 term-signal: #f stop-signal: #f] 5d2b00>)'.
builder for `/gnu/store/9dfr4cn5qpxp9jxj5jwp9nrjw4y4wsnr-qemu-image.drv' failed with exit code 1
build of /gnu/store/9dfr4cn5qpxp9jxj5jwp9nrjw4y4wsnr-qemu-image.drv failed
View build log at '/var/log/guix/drvs/9d/fr4cn5qpxp9jxj5jwp9nrjw4y4wsnr-qemu-image.drv.bz2'.
cannot build derivation `/gnu/store/yhzd6g6pw3j4jpxabjbpl0qwf9j232ks-run-vm.sh.drv': 1 dependencies couldn't be built
guix system: error: build failed: build of `/gnu/store/yhzd6g6pw3j4jpxabjbpl0qwf9j232ks-run-vm.sh.drv' failed
--8<---------------cut here---------------end--------------->8---

the permissions on /dev/kvm (via emacs eshell+tramp) are:

--8<---------------cut here---------------start------------->8---
ls -lah /ssh:anemone.mug.biscuolo.net:/dev/kvm 
crw-rw----   1 root           kvm             0 2018-12-18  2018 /ssh:anemone.mug.biscuolo.net:/dev/kvm
--8<---------------cut here---------------end--------------->8---

I'm on Debian 9 and used to run other QEMU images via libvirt
(e.g. virsh --connect qemu:///system start guixsd-test) as user with no
problems (my user is in kvm and libvirt-qemu groups)

please any hint on how I can use "gnu system vm" as a normal user?

Thanks!
Giovanni

-- 
Giovanni Biscuolo

Xelera IT Infrastructures

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: KVM kernel module permission denied on foreign distro

[Giovanni Biscuolo]

[-- Attachment #1: Type: text/plain, Size: 3566 bytes --]

Hi!

Giovanni Biscuolo <g@xelera.eu> writes:

[...]

> I'm on Debian 9 and used to run other QEMU images via libvirt
> (e.g. virsh --connect qemu:///system start guixsd-test) as user with no
> problems (my user is in kvm and libvirt-qemu groups)
>
> please any hint on how I can use "gnu system vm" as a normal user?

I run the same command as root but get the same error (this time I'll
paste the full log)

--8<---------------cut here---------------start------------->8---
$ time sudo -i guix system vm /localhome/g/guix/labs/configuration/container-minimal.scm
[sudo] password for g: 
/localhome/g/guix/labs/configuration/container-minimal.scm:41:19: warning: 'dhcp-client-service' is deprecated, use 'dhcp-client-service-type' instead
substitute: updating substitutes from 'https://ci.guix.info'... 100.0%
The following derivations will be built:
   /gnu/store/9dfr4cn5qpxp9jxj5jwp9nrjw4y4wsnr-qemu-image.drv
   /gnu/store/yhzd6g6pw3j4jpxabjbpl0qwf9j232ks-run-vm.sh.drv
building /gnu/store/9dfr4cn5qpxp9jxj5jwp9nrjw4y4wsnr-qemu-image.drv...
environment variable `PATH' set to `/gnu/store/aya58zrfkl10vd62vzqz9y7b54xgzpfi-qemu-minimal-3.1.0/bin:/gnu/store/5s2nib1lrd2101bbrivcl17kjx1mspw6-coreutils-8.30/bin'
creating qcow2 image of 70.00 MiB...
Formatting '/gnu/store/4mz1qqv7h5g5885q1aq0izlmy01knf1g-qemu-image', fmt=qcow2 size=73400320 cluster_size=65536 lazy_refcounts=off refcount_bits=16
Could not access KVM kernel module: Permission denied
qemu-system-x86_64: failed to initialize KVM: Permission denied
Backtrace:
           2 (primitive-load "/gnu/store/hyaagi7v0qda56rivy893px3rvz?")
In ./gnu/build/vm.scm:
    146:2  1 (load-in-linux-vm _ #:output _ #:qemu _ #:memory-size _ ?)
In ./guix/build/utils.scm:
    616:6  0 (invoke _ . _)

./guix/build/utils.scm:616:6: In procedure invoke:
Throw to key `srfi-34' with args `(#<condition &invoke-error [program: "qemu-system-x86_64" arguments: ("-nographic" "-no-reboot" "-m" "256" "-object" "rng-random,filename=/dev/urandom,id=guixsd-vm-rng" "-device" "virtio-rng-pci,rng=guixsd-vm-rng" "-virtfs" "local,id=store_dev,path=/gnu/store,security_model=none,mount_tag=store" "-virtfs" "local,id=xchg_dev,path=xchg,security_model=none,mount_tag=xchg" "-virtfs" "local,id=tmp_dev,path=tmp,security_model=none,mount_tag=tmp" "-kernel" "/gnu/store/y5aiijqiqna1y8ypn6c0jp367813xxnc-linux-libre-4.20.3/bzImage" "-initrd" "/gnu/store/xdpsk95srxg6dvvy8pj3njxwk02pphpl-raw-initrd/initrd.cpio.gz" "-device" "virtio-blk,drive=myhd" "-drive" "if=none,file=/gnu/store/4mz1qqv7h5g5885q1aq0izlmy01knf1g-qemu-image,format=qcow2,id=myhd" "-enable-kvm" "-append" "panic=1 --load=/gnu/store/wxrmx10lmyrif8136gndxhr1msnhkrf1-linux-vm-loader console=ttyS0" "-net" "nic,model=virtio") exit-status: 1 term-signal: #f stop-signal: #f] 5d2b00>)'.
builder for `/gnu/store/9dfr4cn5qpxp9jxj5jwp9nrjw4y4wsnr-qemu-image.drv' failed with exit code 1
build of /gnu/store/9dfr4cn5qpxp9jxj5jwp9nrjw4y4wsnr-qemu-image.drv failed
View build log at '/var/log/guix/drvs/9d/fr4cn5qpxp9jxj5jwp9nrjw4y4wsnr-qemu-image.drv.bz2'.
cannot build derivation `/gnu/store/yhzd6g6pw3j4jpxabjbpl0qwf9j232ks-run-vm.sh.drv': 1 dependencies couldn't be built
guix system: error: build failed: build of `/gnu/store/yhzd6g6pw3j4jpxabjbpl0qwf9j232ks-run-vm.sh.drv' failed
41.463 secs
--8<---------------cut here---------------end--------------->8---

so even with root it fails: maybe something to do with my libvirtd
daemon service?

WDYT?

Thanks!
Giovanni

-- 
Giovanni Biscuolo

Xelera IT Infrastructures

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: KVM kernel module permission denied on foreign distro

[Pierre Neidhardt]

[-- Attachment #1: Type: text/plain, Size: 568 bytes --]

If I'm not mistaken, this is because you need to add the builders to the 'kvm'
group.  From the manual ((guix) 2.4.1 Build Environment Setup):

--8<---------------cut here---------------start------------->8---
To use ‘guix system vm’ and related commands,
you may need to add the build users to the ‘kvm’ group so they can
access ‘/dev/kvm’, using ‘-G guixbuild,kvm’ instead of ‘-G guixbuild’
(*note Invoking guix system::).
--8<---------------cut here---------------end--------------->8---

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: KVM kernel module permission denied on foreign distro

[Giovanni Biscuolo]

[-- Attachment #1: Type: text/plain, Size: 1728 bytes --]

Hi Pierre,

Pierre Neidhardt <mail@ambrevar.xyz> writes:

> If I'm not mistaken, this is because you need to add the builders to the 'kvm'
> group.

yes! this solved the "Could not access KVM kernel module: Permission
denied" I had with "guix system vm" (both as user and root):

  $ for i in `seq -w 1 10`; do sudo usermod -G guixbuild,kvm guixbuilder$i; done
  $ sudo systemctl restart guix-daemon.service # since my init system is systemd

the fact that builds are made by a dedicated daemon using dedicated
unprivileged users (guixbuilder${i}) in an isolated environment is
pretty new to me and sometimes I forget it :-S

> From the manual ((guix) 2.4.1 Build Environment Setup):
>
> --8<---------------cut here---------------start------------->8---
> To use ‘guix system vm’ and related commands,
> you may need to add the build users to the ‘kvm’ group so they can
> access ‘/dev/kvm’, using ‘-G guixbuild,kvm’ instead of ‘-G guixbuild’
> (*note Invoking guix system::).
> --8<---------------cut here---------------end--------------->8---

I read that but skipped that because lazy people like me use installers
:-), so I used the shell installer script mentioned in "(guix)Binary
Installation" and that does not add guixbuilder${i} users to the kvm
group in "sys_create_build_user()" shell function

moreover, "(guix)Invoking guix system" should mention this in the "`vm`"
section, in case users (like me) skipped or misunderstood that part of
"(guix)Build Environment Setup" for any reason

tomorrow I'm going to propose a couple of patches to address both of the
above mentioned issues

Thanks!
Giovanni

-- 
Giovanni Biscuolo

Xelera IT Infrastructures

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: KVM kernel module permission denied on foreign distro

[Pierre Neidhardt]

[-- Attachment #1: Type: text/plain, Size: 211 bytes --]

Good to hear!

> tomorrow I'm going to propose a couple of patches to address both of the
> above mentioned issues

Great, that would be very useful indeed!

-- 
Pierre Neidhardt
https://ambrevar.xyz/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]