From df56379556e77b128b040ea9b9e835e806d510e0 Mon Sep 17 00:00:00 2001
From: Pathfinder <pathfinder@ku-it.org>
Date: Tue, 27 Oct 2026 15:32:41 +0100
Subject: [PATCH] libvirt group gate: virt-manager alone justifies membership
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fresh-VM repro: user in yuri+wheel with virt-manager installed. Gate was
'pkg_installed libvirt', but virt-manager does NOT require the 'libvirt'
metapkg (verified vs F44 package page: requires libvirt-glib etc., client
side only) — so the usermod never fired.

Gate now: libvirt OR libvirt-daemon OR libvirt-daemon-driver-qemu OR
virt-manager packages, or an existing /usr/sbin/libvirtd binary.
---
 lib/session.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/session.sh b/lib/session.sh
index 421b2d2..32fe710 100644
--- a/lib/session.sh
+++ b/lib/session.sh
@@ -129,7 +129,13 @@ UNIT
     # libvirt group: members manage qemu:///system without a polkit prompt.
     # Without this, virt-manager dies on "access denied by policy" even with
     # a working agent (VM-proven). Idempotent; applies after re-login.
-    if pkg_installed libvirt; then
+    #
+    # Gate on the DAEMON, not the 'libvirt' metapkg name: virt-manager only
+    # requires libvirt-glib client-side, so on a fresh VM libvirt can be
+    # functionally present via libvirt-daemon* without rpm -q libvirt passing
+    # (VM-proven: user stuck in yuri+wheel with virt-manager installed).
+    if pkg_installed libvirt libvirt-daemon libvirt-daemon-driver-qemu virt-manager \
+        || [[ -x /usr/sbin/libvirtd ]]; then
         local real_user="${SUDO_USER:-$USER}"
         if ! id -nG "$real_user" 2>/dev/null | grep -qw libvirt; then
             info "Adding $real_user to the libvirt group (re-login to apply)..."