Rootless virtual machines with KVM and QEMU

When testing:

Thats the right thought.

I was right:

Error starting domain: Storage volume not found: no storage vol with matching name 'Kicksecure.qcow2'

Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 71, in cb_wrapper
    callback(asyncjob, *args, **kwargs)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 107, in tmpcb
    callback(*args, **kwargs)
    ~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/usr/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn
    ret = fn(self, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/object/domain.py", line 1384, in startup
    self._backend.create()
    ~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3/dist-packages/libvirt.py", line 1390, in create
    raise libvirtError('virDomainCreate() failed')
libvirt.libvirtError: Storage volume not found: no storage vol with matching name 'Kicksecure.qcow2'

Either .xml define the path, or we change libvirt to the user level location, because by default libvirt dont expect session to be used.

Please choose which way you want to go so i can edit the wiki instructions or the .xml based on it, either:

  • Path comes with .xml (remove default).
  • Edit libvirt to make default point to /home/user/.local/share/libvirt/images instead of /var/lib/libvirt/images/.
1 Like

default points to /home/user/.local/share/libvirt/images in qemu://session on a fresh installation for me. I did not had to take another step to define the storage pool to that directory

2 Likes

Kicksecure or arch? if arch, not what im on.

1 Like

Arch. I got your issue when I have qemu://system xml files defined before

Did you try it on a fresh installed machine or snapshot without an active default storage pool from qemu://system? This seem to matter on my side

1 Like

How to reproduce is straight forward:

  • Install KS
  • Install KVM (user level wiki)
  • Download Whonix or KS on user side on KS (host)
  • Untar libvirt image
  • Edit the .xml and copy/paste the user level method (with “default”)
  • Import/define the .xml
  • Move the image/s to the user level path
  • Run KS/Whonix from virt-manager

Boom error, storage is not defined.

Note: Current version of virt-manager on debian is 5.0 (not 5.1).

2 Likes

Ok. I reproduced your steps on Arch and for me the default storage is in .local. It seems like a virt-manager 5.0 issue that is resolved in 5.1.

I’m helping with testing non KS hosts. If I find some big conflict, it can be added to the wiki

3 Likes

Same for Debian. No directory needs to be created. It is there by default when adding a QEMU user session connection as noted before. I agree that the system connection instructions should be moved to Dev/Deprecated instead of trashed completely.

1 Like

Only the dgram socket feature seems to function; as in it creates the socket at the designated path, while stream sockets don’t go that far. Connectivity on the GW is still effd however with no error message to give a clue on what’s wrong.

Interfaces are listed at the usual ip addresses under ifconfig though

1 Like

This step: mkdir -p ~/.local/share/libvirt/images
should be listed under troubleshooting or known bugs since I don’t encounter it on a vanilla Debian host

Same for this entire section: “Tell libvirt to stop trying to adjust resources limits and force libvirt to skip it”


For the Whonix page

Encrypted Containers section should show the entire xml stanza for the storage section since it has now been changed to use storage pools rather than absolte paths. For a user to correctly use paths again, there must be a full correct example for it as currently used.

There should be no “sudo virsh” anywhere on the page since it is possible to use libvirt rootless so please change it to just virsh

1 Like

I literally reproduced these just now even on Ubuntu (virt-manager coming as 5.1).

Probably gonna need to record a video to prove it.

1 Like

https://www.whonix.org/w/index.php?title=KVM_Testers_Only_Version&oldid=107707&diff=cur

Please re-add --no-install-recommends so we have a deterministic and well understood set of packages.

I suggest to do that soon. Otherwise extracting from wiki history might be cumbersome or impossible (if the wiki is ever restored without history).

Or a CI script. A script that runs on an ephemeral/standardized environment.

1 Like

Which command / program is supposed to create folder ~/.local/share/libvirt/images? In other words, pls delete the folder, re-run the KVM installation commands, in between keep checking the folder exists yet.

For the fun of it, I used AI to create a CI script to find that out. Finding:
virsh pool-build creates the folder.

Virt Manager might create the folder but that doesn’t seem reliable. Also instructions “run Virt Manager, then go back to terminal” sounds weird. There shouldn’t need to be any dependency on Virt Manager anyhow.

According to AI research, there is also a different way without mkdir and without cp / mv.

virsh -c qemu:///session pool-create-as default dir --target "$HOME/.local/share/libvirt/images" --build
virsh -c qemu:///session vol-upload --pool default test.img ./test-src.img

But that seems quite cumbersome.


1 Like

I added it back to Ubuntu, i removed it because Ubuntu bulky anyway.

Yeah, not much of a difference.

1 Like

Tested Whonix 18.2.1.0, working good. With the same issue mentioned above about the path, so i added the patch to fix it and mirrored that to the wiki:

So as for KS:

2 Likes

Can we disable DNS from the host with passt? Like Whonix did with <dns enable="no"/>

1 Like

Better keep storage pools and use instead…?

mkdir -p ~/.local/share/libvirt/images

you mean keep:

<source pool="default" volume="Kicksecure.qcow2"/> ?

It wont work, because it doesn’t point to /home/user/.local/share/libvirt/images/ by default.

Yes.

It should work? mkdir -p + mv? Worked for HulaHoop.

Much more elegant than hardcoded /home/user.

Doesnt work for default/fresh installation of KS, Ubuntu.. i can test more but thats not the point, hulahoop seems to have old distro (keeps upgrading) and already pre-configured KVM before and forgot or so. So my method gonna work for fresh OSs (debian based) while current method doesnt work out of the box.

Yes. You no longer need dnsmasq and can safely disable its process from starting provided that you disable the ‘default’ network that comes with qemu:///system as I had posted in another thread. However passt itself has native dns support and runs in a network namespace. I haven’t seen it open raw ports last I checked. Feel free to test and confirm.

You can look at the passt manual here to further customize dns/dhcp usage:

-D, --dns addr
Instruct the guest (via DHCP, DHVPv6 or NDP) to use addr (IPv4 or IPv6) as a nameserver, as configured (see options --no-dhcp-dns, --dhcp-dns) instead of reading addresses from /etc/resolv.conf. This option can be specified multiple times. Specifying -D none disables usage of DNS addresses altogether. Unlike addresses from /etc/resolv.conf, addr is given to the guest without remapping. For example --dns 127.0.0.1 will instruct the guest to use itself as nameserver, not the host.