From e99c60a0737751a42f993124c3817b10890aea63 Mon Sep 17 00:00:00 2001
From: Pathfinder <pathfinder@ku-it.org>
Date: Tue, 27 Oct 2026 15:14:22 +0100
Subject: [PATCH] Session prereqs: libvirt group membership when libvirt is
 installed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The error CHANGED on the VM: 'no polkit agent' -> 'access denied by
policy' — the agent unit works; polkit now denies because the user is
not in the libvirt group (fresh run without picking QEMU from the menu,
or no re-login after the pick).

install_session_prereqs now adds the user to the libvirt group whenever
libvirt is installed (idempotent via id -nG check), decoupled from the
advanced-menu choice. Applies after re-login.
---
 lib/session.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lib/session.sh b/lib/session.sh
index 8454b57..421b2d2 100644
--- a/lib/session.sh
+++ b/lib/session.sh
@@ -125,4 +125,15 @@ UNIT
         sudo ln -sf ../polkit-agent.service \
             /etc/systemd/user/graphical-session.target.wants/polkit-agent.service
     fi
+
+    # libvirt group: members manage qemu:///system without a polkit prompt.
+    # Without this, virt-manager dies on "access denied by policy" even with
+    # a working agent (VM-proven). Idempotent; applies after re-login.
+    if pkg_installed libvirt; then
+        local real_user="${SUDO_USER:-$USER}"
+        if ! id -nG "$real_user" 2>/dev/null | grep -qw libvirt; then
+            info "Adding $real_user to the libvirt group (re-login to apply)..."
+            sudo usermod -aG libvirt "$real_user"
+        fi
+    fi
 }