Cockpit: machines: list is empty nothing detected when libvirt-dbus pkg is installed

[dreamcat4]

Cockpit version: 202.1-1
OS: Ubuntu 19.10
Page: Machines

This problem was originally reported here:

https://github.com/cockpit-project/cockpit/issues/10121#issuecomment-515642689

And I can confirm it's still an issue as of today right now.

Steps to reproduce

1. Install the package libvirt-dbus
2. Install the package cockpit-machines
3. Try to view your existing vms in the machines tab --> it's empty

Problem is that:

Once the user knows the workaround, then they can then know to uninstall the package libvirt-dbus and then cockpit will start working again. Which is pretty easy solution. However there is no way for the user to know this thing, to remove that other package.

The other main problem is that if there is a different package also installed on the system which actually requires libvirt-dbus... that will then lead to a conflict such that cockpit machines tab is broken since the conflicting package is a dependency of something else and therefore cannot be uninstalled / removed. So then maybe fixing this bug is kindda worthwhile.

Not sure the problem. But there is code referenced in other issue (linked included above). So maybe it's touching that parts of the code still. Perhaps it's was already supposed to be fixed previously. But later ended up coming back again in the form of a regression. Or could not fully test on the other platform.

[marusak]

@KKoukiou you may know what is happening?

[KKoukiou]

@dreamcat4 uninstalling libvirt-dbus is not a valid work around unfortunately. In fact uninstallaling that package just uses virsh as a communication means with libvirt but we plan to deprecate that soon.
So please help me figure out what's actually wrong by pasting here the console logs when libvirt-dbus is installed. You should be able to see some errors in the browser console.

[dreamcat4]

Hello again,
@KKoukiou It's saying in the javascript console logs that it cannot access libvirt-sock. However I'm unsure as to what credentials it is trying to access it with since my own username id is already appears to have been configured to be included with regular unix group level access permissions being setup as a member of the group libvirt:

lla /var/run/libvirt/libvirt-sock
srwxrwx--- 1 root libvirt 0 Dec 31 22:14 /var/run/libvirt/libvirt-sock=

$ cat /etc/group | grep libvirt
libvirt:x:139:id  # <------------- here
libvirt-qemu:x:64055:libvirt-qemu,id
libvirt-dnsmasq:x:140:
libvirtdbus:x:997:id

So if cockpit isn't connecting under the credentials of my logged in user then what is it connecting as? Or maybe it's some other issue? IDK

Content Security Policy: The page's settings blocked the loading of a resource at eval ("default-src").
Content Security Policy: The page's settings blocked the loading of a resource at inline ("default-src"). common.js:2:319
This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. machines
Content Security Policy: The page's settings blocked the loading of a resource at eval ("default-src").
Content Security Policy: The page's settings blocked the loading of a resource at inline ("default-src"). common.js:2:319
Content Security Policy: The page's settings blocked the loading of a resource at eval ("default-src").
Content Security Policy: The page's settings blocked the loading of a resource at inline ("default-src"). common.js:2:319
This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. index.html
This page uses the non standard property “zoom”. Consider using calc() in the relevant property values, or using “transform” along with “transform-origin: 0 0”. index.html
Source map error: Error: request failed with status 404
Resource URL: https://127.0.0.1:9090/cockpit/$aeb573d4937985f7a12f90c90a684e0eba9f66af713c40ecd17157e3cd3247aa/shell/index.css
Source Map URL: index.css.map
grep: /sys/class/dmi/id/power/autosuspend_delay_ms: Input/output error
cockpit.js:589:36
Source map error: Error: request failed with status 404
Resource URL: https://127.0.0.1:9090/cockpit/$aeb573d4937985f7a12f90c90a684e0eba9f66af713c40ecd17157e3cd3247aa/base1/patternfly.css
Source Map URL: patternfly.min.css.map
index.js: Setting LibvirtDBus as virt provider. machines.js:75:522014
Source map error: Error: request failed with status 404
Resource URL: https://127.0.0.1:9090/cockpit/$aeb573d4937985f7a12f90c90a684e0eba9f66af713c40ecd17157e3cd3247aa/base1/cockpit.js
Source Map URL: cockpit.min.js.map
Source map error: Error: request failed with status 404
Resource URL: https://127.0.0.1:9090/cockpit/$aeb573d4937985f7a12f90c90a684e0eba9f66af713c40ecd17157e3cd3247aa/machines/machines.js
Source Map URL: machines.min.js.map
getAllInterfaces action failed: {"problem":null,"name":"org.libvirt.Error","message":"Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied"} machines.js:75:188336
GET_ALL_VMS action failed: {"problem":null,"name":"org.libvirt.Error","message":"Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied"} machines.js:75:184524
GetDomainCapabilities failed: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied machines.js:75:189352
GET_ALL_STORAGE_POOLS action failed: {"problem":null,"name":"org.libvirt.Error","message":"Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied"} machines.js:75:184243
GET_ALL_NETWORKS action failed: {"problem":null,"name":"org.libvirt.Error","message":"Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied"} machines.js:75:183506
GET_ALL_NODE_DEVICES action failed: {"problem":null,"name":"org.libvirt.Error","message":"Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied"} machines.js:75:183855
NodeGetMemoryStats failed: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied machines.js:75:190926

So please let me know if you need any further information or otherwise @ejbolt had previously offered to provide extra logging etc. for this issue

[KKoukiou]

@dreamcat4 do you get the same error when you execute from CLI virsh -c qemu:///system list --all or any other command with your user?

[dreamcat4]

No, the command works from my id username

[id:~] $ virsh -c qemu:///system list --all
 Id   Name          State
------------------------------
 5    win10         paused
 -    ubuntu18.10   shut off

θ98° [id:~] $ 

[KKoukiou]

@dreamcat4 and same for the libvirt-dbus API?
$ gdbus call --system --dest org.libvirt --object-path /org/libvirt/QEMU --method org.libvirt.Connect.ListDomains 0

[dreamcat4]

Hey... that one failed

$ gdbus call --system --dest org.libvirt --object-path /org/libvirt/QEMU --method org.libvirt.Connect.ListDomains 0
Error: GDBus.Error:org.libvirt.Error: Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied

[dreamcat4]

Perhaps if i were to add the users libvirtdbus and libvirt-qemu to the group libvirt then restart my PC. Then see what happens? Or there is something else I should be trying here?

[KKoukiou]

@dreamcat4 Or try to follow the steps mentioned here https://www.libvirt.org/dbus.html#usage. Seems exactly your issue.

[dreamcat4]

Yeah... just rebooted and its working now.

Thing is: it's not just my issue, it affects all of the users on ubuntu platform. Not sure what you want to do about it though. If it's something can be solved in packaging, or to display some new error message, or explain in the documentation.

[dreamcat4]

Just to be a little clearer about what the solution / workaround is here. In case anybody else needs to be doing this:

# ======
# install cockpit on ubuntu 19.10
sudo apt-get install -y cockpit cockpit-machines libvirt-dbus

# fix for issue 'machines list is empty'
# https://github.com/cockpit-project/cockpit/issues/13343
sudo usermod -a -G libvirt libvirtdbus
sudo usermod -a -G libvirt libvirt-qemu

# must reboot (or restart the affected systemd services) for changes to take effect

[martinpitt]

@dreamcat4: This is tracked here: https://bugs.launchpad.net/ubuntu/+source/libvirt-dbus/+bug/1802005

[Routhinator]

As an FYI to anyone finding this. The ONLY thing required to fix this on Ubuntu 20.04, and potentially others, is:

sudo usermod -a -G libvirt libvirtdbus

DO NOT add the libvirt-qemu user to the libvirt group, or VMs may be able to access the socket, which would open up a security hole.

Check the bug report for details:

https://bugs.launchpad.net/ubuntu/+source/libvirt-dbus/+bug/1802005

Also Ubuntu does not use the polkit files for access, that configuration is not needed.