Can't redirect USB to QEMU-KVM guest

Hi all,
Came across this email exchange that describes issue i’m having with USB redirection to guests: http://lists.opensuse.org/opensuse-virtual/2014-02/msg00000.html
This is from February of this year and issue is still present. So i was thinking before going and creating bug report on bugzilla i would try my luck here, who knows, maybe i’m missing something very obvious.
Basically what i’m trying to do is to redirect connected to my system (host) USB drive to (qemu-kvm) virtual guest machine. From virtual machine viewer menu i select “Virtual Machine” -> " Redirect USB". Immediately i get list of all present USB devices, and the moment i chose one i get pop up window “USB redirection error” with following information:

g-exec-error-quark: Could not redirect Polar Electro Polar RC3 GPS [0da4:0006] at 3-6: Failed to execute child process "/usr/bin//spice-client-glib-usb-acl-helper" (No such file or directory) (8)

Log of virtual machine is empty, tried starting libvirtd in verbose mode in hope to see more, but nothing.
some version info:
openSUSE Factory
qemu-kvm 2.1.0-2.4
libvirt-daemon-qemu 1.2.8-3.3
libusb-0_1-4 0.1.13-31.1
libusb-1_0-0 1.0.19-3.1

Can someone help me out here?
thnx in advance.

On Mon 06 Oct 2014 01:56:01 PM CDT, cyclingGeorgian wrote:

Hi all,
Came across this email exchange that describes issue i’m having with USB
redirection to guests:
http://lists.opensuse.org/opensuse-virtual/2014-02/msg00000.html
This is from February of this year and issue is still present. So i was
thinking before going and creating bug report on bugzilla i would try my
luck here, who knows, maybe i’m missing something very obvious.
Basically what i’m trying to do is to redirect connected to my system
(host) USB drive to (qemu-kvm) virtual guest machine. From virtual
machine viewer menu i select “Virtual Machine” -> " Redirect USB".
Immediately i get list of all present USB devices, and the moment i
chose one i get pop up window “USB redirection error” with following
information:

Code:

g-exec-error-quark: Could not redirect Polar Electro Polar RC3 GPS
[0da4:0006] at 3-6: Failed to execute child process
“/usr/bin//spice-client-glib-usb-acl-helper” (No such file or
directory) (8) --------------------

Log of virtual machine is empty, tried starting libvirtd in verbose mode
in hope to see more, but nothing.
some version info:
openSUSE Factory
qemu-kvm 2.1.0-2.4
libvirt-daemon-qemu 1.2.8-3.3
libusb-0_1-4 0.1.13-31.1
libusb-1_0-0 1.0.19-3.1

Can someone help me out here?
thnx in advance.

Hi
Are the libsplice-client files installed?


Cheers Malcolm °¿° LFCS, SUSE Knowledge Partner (Linux Counter #276890)
openSUSE 13.1 (Bottle) (x86_64) GNOME 3.10.1 Kernel 3.11.10-21-desktop
If you find this post helpful and are logged into the web interface,
please show your appreciation and click on the star below… Thanks!

According to your error,
You probably don’t have the required spice libraries installed.
I don’t re-direct USB devices, so I haven’t set up what you’re trying to do so I don’t know if you only need to install client libraries or if a spice server has to be setup as well… So I can’t specify exactly which files you need (maybe install many packages in a shotgun approach?).

But,
Before you proceed further you might want to consider whether you really should be setting up USB pass through. It’s rarely used (eg support a USB fingerprint scanner). In general you want to avoid any kind of hardware pass through because only one “machine” can utilize that resource at a time, ie if you setup pass through, then that device won’t be available for other Guests and the Host.

For things like USB storage, you want to set it up as a USB device recognized by the Host, and then that storage can be setup as normal storage (attach new disk in Guest properties).

If you do continue to use a device that utilizes spice, you might want to read up on what spice is, and what it can provide. One cool feature is that the spice protocol can piggy back on TCP/IP so you can connect to remote USB devices.

TSU

thnx guys for replies and sorry for staying away from my own thread for so long.
@malcolm - no i don’t have libspice installed, and i can’t find it, not in the “standard” factory repos anyway.
@tsu - it probably was unfortunate use of “usb drve” on my count, but it’s not about storage but about my Polar RC3 sports watch that needs to be synced with server… and that thing works only on windows machines (virtual in my case). I have successfully used it in this fashion on Fedora 19/20, but since i moved to factory i got this error :(. And i wouldn’t even think of attaching usb flash drive (storage) to virtual :slight_smile:

First step probably is to identify how your watch is classified… Generally all device detection starts with a general classification of the type of device. From there, different methods are applied to either mounting or interfacing with specific types of services.

Maybe some documentation on what is happening when attached to any other OS can provide some hints what your watch connection requires… Besides, even if you mounted your watch using hardware pass-through, you’d still need some kind of app to do whatever is desired? ie, transfer files? Sync services?

TSU

Well, i don’t know why i didn’t do this at the very beginning, and i don’t know how i came up with idea that libspice was not in repos - i wasn’t drunk or anything :)… but i search for a provider of spice-client-glib-usb-acl-helper, it happens to be spice-gtk. After installing it error went away and it seemed that usb redirect was successful. But it is not, since sync application is not peaking up on the watch, which normally would happened automatically and sync process would be initialized.
Whet i look at systemctl status libvirtd it shows me another error:
failed to execute /usr/lib64/libvirt/libvirt_leaseshelper: Permission denied
Can anyone elaborate on that? Maybe that’s a problem??

well… just noticed something…
as soon as i try to redirect usb i get authentication window before me telling me that redirecting usb is a privileged process. Right after entering root pw i get following error:

spice-client-error-quark: Could not redirect Polar Electro Polar RC3 GPS [0da4:0006] at 3-5: Error setting USB device node ACL: 'Error setting facl: Operation not permitted' (0)

Although I wouldn’t recommend as normal practice, <for testing purposes only> you might login as root and then try to connect to your watch.

TSU

Hi
I have openSUSE 13.2 witn KVM and I had that problem too and found follow decision from https://bugzilla.redhat.com/show_bug.cgi?id=1005009. Just run command

chmod u+s /usr/bin/spice-client-glib-usb-acl-helper

and all is OK. I’ve got USB flash disk and USB-COM cabel in my guest Windows 7 x64. And little more. For disable asking root password for low level USB device access I made little changes in file /usb/share/polkit-1/actions/org.spice-spice.lowlevelusbaccess.policy.
Before changes I had follow

  &lt;allow_any&gt;auth_admin&lt;/allow_any&gt;
  &lt;allow_inactive&gt;no&lt;/allow_inactive&gt;
  &lt;allow_active&gt;auth_admin&lt;/allow_active&gt;

After I have

  &lt;allow_any&gt;yes&lt;/allow_any&gt;
  &lt;allow_inactive&gt;no&lt;/allow_inactive&gt;
  &lt;allow_active&gt;yes&lt;/allow_active&gt;

Look man polkit for these options.
And now I have no need root password for USB redirection.

Thank you sooooo much. It worked… i don’t have to run each week to my coworkers computer (windows) any more… :slight_smile:
Still don’t get why it would need suid though… it has asked me for root pwd so i assume virt manager was trying to run command ar root already…

PS and i think you meant /usr/share/polkit-1/actions/org.spice-space.lowlevelusbaccess.policy :slight_smile: :slight_smile: :slight_smile: and not /usb/…/spice-spice

Just tying up this thread a bit…

For anyone who has problems mounting a USB device (not just to a virtual Guest), the spice protocol is an interesting alternative to normal direct USB(and other devices) access… The spice protocol has networking properties which might enable a system to detect and categorize the device differently.

In fact, the spice protocol can be used to connect directly to a USB device over a TCP/IP network(of course, this also requires the USB device to also be attached directly to the network).

TSU

Exactly. I’m ashamed for these errors :frowning: and I’m glad to help you.

Running the Command chmod u+s /usr/bin/spice-client-glib-usb-acl-helper

Has helped me.

Now the redirection works perfectly. Better than what works on Virtualbox.

I also had missing spice-gtk, I installed it and then I ran chmod u+s /usr/bin/spice-client-glib-usb-acl-helper

Issue fixed.

By the way this my first post at OpenSuse forums. I am coming over to OpenSuse Leap from Arch and Ubuntu.

I am on Leap42.1 with GNOME and I love the system. OpenSuse LEAP is the best experience I have ever had. I have used OpenSuse on and off for a few years, Starting from 11.04 But Leap is just the best. It was a good Decision .

1 Like

Same issue with Leap 42.2 and KVM ( using XP SP3 guest vm ).

solved with

chmod u+s /usr/bin/spice-client-glib-usb-acl-helper

To install drivers for windows xp

  1. use Fedora repo and download the .iso
    https://fedorapeople.org/groups/virt/virtio-win/virtio-win.repo2. mount the .iso with image mounter to extract floppy image for XP additional 32 bits drivers

  2. add floppy drive pointing on virtio-win-0.1.126_x86.vfd in XP vm guest

  3. at install procedure choose to add the drivers

Hope this will help anyone.

Luco:)

Thank you very much for this solution!!!

I’m using leap 42.3 with qemu/KVM and libvirt. This thread is still the only reliable source of information about spice usb redirection.

I’m going to open a bug.

Thank you very much!

Just for reference: this is the bug I opened on this issue:
https://bugzilla.novell.com/show_bug.cgi?id=1072029

I had this thread bookmarked, because I used this workaround also.

But you can add the following to /etc/permissions.local:

/usr/bin/spice-client-glib-usb-acl-helper    root:root    4755

and create a file in /etc/polkit-1/rules.d like 20-spice-usbaccess.rules which contains:


/************************************\
* Overruling default privileges      *
* see man set_polkit_default_privs   *
\************************************/
polkit.addRule(function(action, subject) {
    if (action.id == "org.spice-space.lowlevelusbaccess") {
        return polkit.Result.YES;
    }
});

// vim: syntax=javascript

Then you don’t have to apply the workaround everytime there is an update

May I propose a slight variation of the script with some security checks applied:

/************************************\
* Overruling default privileges      *
* see man set_polkit_default_privs   *
\************************************/
polkit.addRule(function(action, subject) {
    if (action.id == "org.spice-space.lowlevelusbaccess" && subject.local && 
            subject.active && subject.isInGroup("users")) {
        return polkit.Result.YES;
    }
});

// vim: syntax=javascript

This checks whether the users who asks for the permission is local, with active session and belongs to the users group.

Suddenly out of the blue, USB redirection stopped working in my Windows VM. When I insert the USB stick I’m getting a sequence of error pop up messages, like the one I grabbed below:

εικόνα

I didn’t change anything in the configuration, I got only spice updates from the OpenSUSE (Leap 15.4).