RHEL 6 KVM Give local host user ability to manage just their vm

Question

I am running KVM on a RHEL6 machine that currently runs 4 guest VMs. I have been tasked with finding a way to give a local user (local to the host machine) administrative power over only their assigned VM, be it through virt-manager or another service.

For example, say there was a local user on the host machine named "foo" and we have given him the guest VM "bar" to use. I am wondering if there is a way to give "foo" the ability to ssh in to the host machine and run virt-manager (or some other service) to administer their vm but restrict their access so they are only able to view/manage "bar" and not the other 3 VMs.

We are running this virtualization server to host multiple VMs for research groups and we would like to be able to give each of those research groups the ability to start/stop their own VMs, but for security reasons we want to be able to restrict their access to only their assigned VM. We don't want to give them any other administrative powers on the host machine.

Is this possible or is there an application to do this? If so, would someone be able to point me in the right direction? I'm rather new to administering servers and VMs so I'm not too sure where to start looking (Google hasn't given me anything yet either).

Answer 1

You can do that with basic unix permissions, if you bypass libvirt. To run kvm, you need read-write access to /dev/kvm, the block devices you're using, and the ability to use the network tap device. So,

• Create a kvm group if it doesn't already exist, add all the users to that group, set /dev/kvm to 0660 permssions, and owned by that group.
• Give ownership of the block devices or disk images that each VM uses to the respective users.
• Use tunctl to create a persistent tap device with the owner set for each VM, and add it to the appropriate bridge.

Then the users can just run the kvm command-line as themselves, using whatever mechanism they want, e.g. kvm -foo -bar & or inside screen.

Disadvantages:

• Allows users to run more VMs by creating their own disk images and using the user net device. That doesn't really present any security risk, though, except resource usage.
• Doesn't use libvirt, which RedHat is aligned with. I've never been a big fan of libvirt, though; it doesn't give you all the kvm features and doesn't really have much extra usefulness, unless you're trying to be agnostic to the underlying virt technology.

Answer 2

A simple solution might be to figure out what tasks the users would need to perform on their VM and add very specific sudo rules to allow those commands, or a helper script that runs those commands as root but is aware of your specific security requirements.