From nobody Tue Jun 18 08:09:45 2024 X-Original-To: freebsd-virtualization@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4W3KDv4dxXz5NZ9M for ; Tue, 18 Jun 2024 08:10:23 +0000 (UTC) (envelope-from marietto2008@gmail.com) Received: from mail-pj1-x1032.google.com (mail-pj1-x1032.google.com [IPv6:2607:f8b0:4864:20::1032]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4W3KDv2M2nz4ns6 for ; Tue, 18 Jun 2024 08:10:23 +0000 (UTC) (envelope-from marietto2008@gmail.com) Authentication-Results: mx1.freebsd.org; none Received: by mail-pj1-x1032.google.com with SMTP id 98e67ed59e1d1-2c6e94131cfso481156a91.3 for ; Tue, 18 Jun 2024 01:10:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1718698222; x=1719303022; darn=freebsd.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=2tVYk65pVaoyKkfABNhRC/CJUoXUaiYz19/jdIuTE1s=; b=l+1GpFHNyPWTSYPSBU+Rc89Z+wS3hZVkrWDv+1px3agOW8JEsL4xXhQIdI0Tx0ThR6 IAYjU2EEpVwJg/8lK5u8ymECvsslAebzQWIlN7I99fFUfkXVHo8oK6+ou9SXiQlE58Zw piUheltgmQrOvEotv50gYJYlNKX7qlYr6uiFYdTj1Tp3VRq5d092kKGB1UN/r3xlkz4H r1+cDNyaWxe7PlhnwtVciYrR6uK0zB9+yjw35YKGR+Tu1yDgamxOx3tbu2QoEduKucuY 9+LabZmRzjQwOvufQffBiapX/dm0wUrFJvLqJxc+kwXPlkamb8Hvn0+nSH7t1L/0Jkrp LkDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1718698222; x=1719303022; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=2tVYk65pVaoyKkfABNhRC/CJUoXUaiYz19/jdIuTE1s=; b=F5Yr/UlnGojYhOmspwm+Qe2qg8SawemP7Cx8kM/UVgoyaH5VZ6BmIUxJlCuDSif94s DWBqFN52a0gjqkojdSV6gZD7Zc0vWAwm1r4bUUTDtdzWOQZCIy/8Fz91HAQyzA6I1AfN qi+f7u2HckW/GzhI9R8BopXIf8C6rU/04f6LPBMZrNwn6iRp1he75VyLI51Ywu2YfdS8 okS+M5rRC1SnN9m1KiRtCOCAe5uyqPa1xzDYOX7HZQVYBAgxdK8sohzTYsEqCIJn8NT4 0xjSXpUfVY8Apmr+CE068+fE5oPIgktqnKfeP4YzghQFVzYpSNwTaTQO2rTKw/G4CJnQ 7DQQ== X-Gm-Message-State: AOJu0YxpNtjVStUCGHURQuKnY1AqpgVAKd8TKLtNJuR2Xa8H5DlRFbXl qwyxcZcWN481L+VVyk4Gcz7XSU4BIMYtMDGzjc+K2QTCPTakcLQNbyQl9rUm2aUjEi9Rcj4C88O Ge0CNREzGvPVgA586grVXviVQu/o8vNWCXGk= X-Google-Smtp-Source: AGHT+IHRV/vqPMmkv4NnakvDSmoDoL+b7Iz/HcnX8F3DKZTh3zDj4KICx1RgwkzRtbdQriww4yAYKlGChGzmcSJPvPA= X-Received: by 2002:a17:90b:8d5:b0:2c2:cefc:abe2 with SMTP id 98e67ed59e1d1-2c4dbb41b40mr14132473a91.31.1718698221782; Tue, 18 Jun 2024 01:10:21 -0700 (PDT) List-Id: Discussion List-Archive: https://lists.freebsd.org/archives/freebsd-virtualization List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-virtualization@freebsd.org Sender: owner-freebsd-virtualization@FreeBSD.org MIME-Version: 1.0 References: In-Reply-To: From: Mario Marietto Date: Tue, 18 Jun 2024 10:09:45 +0200 Message-ID: Subject: Re: How to launch a bhyve vm as normal user,without being root To: Odhiambo Washington Cc: FreeBSD virtualization Content-Type: multipart/alternative; boundary="000000000000fc5089061b259c17" X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US] X-Rspamd-Queue-Id: 4W3KDv2M2nz4ns6 --000000000000fc5089061b259c17 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable This is mine : # permit :wheel # permit nopass keepenv marietto # permit nopass keepenv root as root permit nopass marietto cmd qemu-system-x86_64-debian_fs permit nopass marietto cmd qemu-system-x86_64_debian_now permit nopass marietto cmd qemu-system-x86_64_debian_proxy permit nopass marietto cmd qemu-system-x86_64_debian_warp permit nopass marietto cmd qemu-system-x86_64-debian_tuxler permit nopass marietto cmd zpool permit nopass marietto cmd mount permit nopass marietto cmd fsck permit nopass marietto as root cmd /usr/sbin/bhyve-win permit nopass marietto as root cmd /usr/sbin/bhyve-lin permit nopass marietto as root cmd /bhyve/12-Win-11-vm12 permit nopass marietto as root cmd /bhyve/01-Ubuntu-2310-vm1 permit nopass marietto as root cmd /bhyve/10-Debian-Now_wine-tkg-vm10 permit nopass marietto as root cmd /bhyve/02-Ubuntu-2310-vm2-hidden I prefer to run as root only some specific applications. On Tue, Jun 18, 2024 at 8:53=E2=80=AFAM Odhiambo Washington wrote: > ######/usr/local/etc/doas.conf######################### > permit :wheel > permit nopass keepenv :wheel > permit alice as root > permit keepenv bob as root > permit cindy as root cmd pkg args update > permit cindy as root cmd pkg args upgrade > permit nolog david as root cmd id > permit www as root cmd pfctl > permit nopass *wash* as root cmd bhyve > > ####### /usr/local/bhyve-vms/scripts/debian.sh############## > #!/usr/bin/env bash > if ! kldstat | grep -w vmm.ko > then > kldload -v vmm > fi > if ! kldstat | grep -w nmdm.ko > then > kldload -v nmdm > fi > /usr/sbin/bhyve -S -c sockets=3D2,cores=3D2,threads=3D2 -m 4G -w -H -A \ > -s 0,hostbridge \ > -s 4,ahci-hd,/usr/local/bhyve-vms/Debian/debian.img,bootindex=3D1 \ > -s 5,virtio-net,tap3 \ > -s 7,virtio-9p,sharename=3D/ \ > -s 8,hda,play=3D/dev/dsp,rec=3D/dev/dsp \ > -s 29,fbuf,tcp=3D0.0.0.0:5904,w=3D1600,h=3D950 \ > -s 30,xhci,tablet \ > -s 31,lpc -l com1,stdio \ > -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI.fd \ > debian > > And all I do is `doas /usr/local/bhyve-vms/scripts/debian.sh`. > > > On Mon, Jun 17, 2024 at 6:46=E2=80=AFPM Mario Marietto > wrote: > >> Can you paste here the contents of doas.conf and debian.sh ? thanks. >> >> On Mon, Jun 17, 2024 at 5:35=E2=80=AFPM Odhiambo Washington >> wrote: >> >>> >>> >>> On Mon, Jun 17, 2024 at 5:13=E2=80=AFPM Mario Marietto >>> wrote: >>> >>>> Nice idea,but it does not work : >>>> >>> >>> It worked for me! >>> >>> I created a bash script file named debian.sh which contained all the >>> bhyve args to create the VM, then I just did: >>> >>> doas debian.sh >>> >>> And I actually successfully installed the VM and it's running >>> >>> >>> -- >>> Best regards, >>> Odhiambo WASHINGTON, >>> Nairobi,KE >>> +254 7 3200 0004/+254 7 2274 3223 >>> In an Internet failure case, the #1 suspect is a constant: DNS. >>> "Oh, the cruft.", egrep -v '^$|^.*#' =C2=AF\_(=E3=83=84)_/=C2=AF :-) >>> [How to ask smart questions: >>> http://www.catb.org/~esr/faqs/smart-questions.html] >>> >> >> >> -- >> Mario. >> > > > -- > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > In an Internet failure case, the #1 suspect is a constant: DNS. > "Oh, the cruft.", egrep -v '^$|^.*#' =C2=AF\_(=E3=83=84)_/=C2=AF :-) > [How to ask smart questions: > http://www.catb.org/~esr/faqs/smart-questions.html] > --=20 Mario. --000000000000fc5089061b259c17 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
This is mine :

# permit :whe= el
# permit nopass keepenv marietto
# permit nopass keepenv root as= root

permit nopass marietto cmd qemu-system-x86_64-debian_fs
per= mit nopass marietto cmd qemu-system-x86_64_debian_now
permit nopass mari= etto cmd qemu-system-x86_64_debian_proxy
permit nopass marietto cmd qemu= -system-x86_64_debian_warp
permit nopass marietto cmd qemu-system-x86_64= -debian_tuxler
permit nopass marietto cmd zpool
permit nopass mariett= o cmd mount
permit nopass marietto cmd fsck

permit nopass mariett= o as root cmd /usr/sbin/bhyve-win
permit nopass marietto as root cmd /us= r/sbin/bhyve-lin
permit nopass marietto as root cmd /bhyve/12-Win-11-vm1= 2
permit nopass marietto as root cmd /bhyve/01-Ubuntu-2310-vm1
permit= nopass marietto as root cmd /bhyve/10-Debian-Now_wine-tkg-vm10
per= mit nopass marietto as root cmd /bhyve/02-Ubuntu-2310-vm2-hidden
=
I prefer to run as root only some specific applications.


On Tue, Jun 18, 2024 at 8:53=E2=80=AFAM Odhiambo Washington <= odhiambo@gmail.com> wrote:
=
######/usr/local/etc/doas.conf#########################
permit :wheel=
permit nopass keepenv :wheel
permit alice as root
permit keepenv = bob as root
permit cindy as root cmd pkg args update
permit cindy as = root cmd pkg args upgrade
permit nolog david as root cmd id
permit ww= w as root cmd pfctl
permit nopass wash as root cmd bhyve

####### /usr/local/bhyve-vms/scripts/debian.sh########= ######
#!/usr/bin/env bash
if ! kldstat | grep -w vmm.ko
th= en
=C2=A0 =C2=A0 =C2=A0 =C2=A0 kldload -v vmm
fi
if ! kldstat | gr= ep -w nmdm.ko
then
=C2=A0 =C2=A0 =C2=A0 =C2=A0 kldload -v nmdm
fi<= br>/usr/sbin/bhyve -S -c sockets=3D2,cores=3D2,threads=3D2 -m 4G -w -H -A \=
-s 0,hostbridge \
-s 4,ahci-hd,/usr/local/bhyve-vms/Debian/debian.im= g,bootindex=3D1 \
-s 5,virtio-net,tap3 \
-s 7,virtio-9p,sharename=3D/= \
-s 8,hda,play=3D/dev/dsp,rec=3D/dev/dsp \
-s 29,fbuf,tcp=3D0.0.0.0:5904,w=3D1600,h=3D95= 0 \
-s 30,xhci,tablet \
-s 31,lpc -l com1,stdio \
-l bootrom,/usr/= local/share/uefi-firmware/BHYVE_UEFI.fd \
debian

And all I do is `doas /usr/local/bhyve-vms/scripts/debian.sh`.
<= div>

On Mon, Jun 17, 2024 at 6:46=E2=80=AFPM Mario Marietto <= marietto2008@gm= ail.com> wrote:
Can you paste here the contents of doas.conf and de= bian.sh ? thanks.

On Mon, Jun 17, 2024 at 5:35=E2=80=AFPM Odhiambo Washi= ngton <odhiambo@= gmail.com> wrote:


On Mon, Jun 17, 2024 at 5:= 13=E2=80=AFPM Mario Marietto <marietto2008@gmail.com> wrote:
Nice idea,but= it does not work :

It worked f= or me!

I created a bash script file named debian.s= h which contained all the bhyve args to create the VM, then I just did:

doas debian.sh

And I actuall= y successfully installed the VM and it's running


--
<= div>Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004= /+254 7 2274 3223
=C2=A0In=C2= =A0an Internet failure case, the= #1 suspect is a constant: DNS.
"Oh, the cruft.",=C2=A0egrep -v '^$|^.*#'=C2=A0=C2=AF\_(=E3=83=84)_/=C2=AF=C2=A0:-)
[H= ow to ask smart questions:=C2=A0http://www.catb.org/~esr/faqs/smart-questions.html]


--
Mario.


--
Best regards,
Odhiambo WASHINGTON,<= br>Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
=C2=A0In=C2=A0an Internet failure case, the #1 suspect is a constant: DNS.
= "Oh, the cruft.",=C2=A0egre= p -v '^$|^.*#'=C2=A0=C2=AF\_(=E3=83=84)_/= =C2=AF=C2=A0:-)
[How to ask smart questions:=C2=A0http://www.catb.org/~esr/faqs/smart-que= stions.html]


--
Mario.
--000000000000fc5089061b259c17--