reachableceo
76d1910e9d
Added scripts/fix-swtpm-permissions.sh that sets default ACLs on /var/lib/libvirt/swtpm/ so new per-VM state directories inherit libvirt-qemu access. This permanently fixes the "CMD_INIT: 0x9" error caused by libvirtd creating swtpm dirs as root:root. The user runs this ONCE with sudo. ACLs persist across reboots and apply to all new VMs automatically. Updated vm_create error message to reference the fix script. Updated AGENTS.md with corrected swtpm setup instructions. All 523 tests pass, 0 lint warnings. 💘 Generated with Crush Assisted-by: GLM-5.1 via Crush <crush@charm.land>
46 lines
1.6 KiB
Bash
Executable File
46 lines
1.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# Fix swtpm permissions for libvirt TPM emulation
|
|
#
|
|
# PROBLEM: libvirtd (running as root) creates per-VM swtpm state directories
|
|
# as root:root, but swtpm runs as libvirt-qemu and can't write to them.
|
|
# This causes TPM initialization to fail with "CMD_INIT: 0x9 operation failed".
|
|
#
|
|
# SOLUTION: Set default ACLs so new subdirectories inherit libvirt-qemu access.
|
|
#
|
|
# Run this script ONCE with sudo:
|
|
# sudo bash scripts/fix-swtpm-permissions.sh
|
|
|
|
set -euo pipefail
|
|
|
|
SWTPM_DIR="/var/lib/libvirt/swtpm"
|
|
|
|
if [[ "$(id -u)" -ne 0 ]]; then
|
|
echo "ERROR: This script must be run as root (use sudo)"
|
|
exit 1
|
|
fi
|
|
|
|
echo "Fixing swtpm permissions for libvirt TPM emulation..."
|
|
|
|
# Ensure directory exists with correct ownership
|
|
mkdir -p "$SWTPM_DIR"
|
|
chown libvirt-qemu:libvirt-qemu "$SWTPM_DIR"
|
|
|
|
# Set default ACLs so new subdirectories inherit libvirt-qemu read/write/execute
|
|
# This is the permanent fix - new per-VM dirs created by libvirtd will be
|
|
# accessible by libvirt-qemu even though libvirtd creates them as root:root
|
|
setfacl -R -d -m u:libvirt-qemu:rwx "$SWTPM_DIR"
|
|
setfacl -R -m u:libvirt-qemu:rwx "$SWTPM_DIR"
|
|
|
|
# Fix any existing subdirectories
|
|
if [[ -d "$SWTPM_DIR" ]]; then
|
|
find "$SWTPM_DIR" -type d -exec setfacl -d -m u:libvirt-qemu:rwx {} \; 2>/dev/null || true
|
|
find "$SWTPM_DIR" -type d -exec setfacl -m u:libvirt-qemu:rwx {} \; 2>/dev/null || true
|
|
find "$SWTPM_DIR" -type f -exec setfacl -m u:libvirt-qemu:rw {} \; 2>/dev/null || true
|
|
fi
|
|
|
|
echo ""
|
|
echo "Done. Default ACLs set on $SWTPM_DIR"
|
|
echo "New VMs with TPM will now work correctly."
|
|
echo ""
|
|
echo "Verify with: getfacl $SWTPM_DIR"
|