preflight: Ensure crc network is accessible from session libvirt

This is needed to be able to switch to session libvirt, which will be
through machine-driver-libvirt (See
crc-org/machine-driver-libvirt#20)

cmd/crc/cmd/config/config_linux.go

@@ -26,6 +26,8 @@ var (
 	WarnCheckCrcNetwork              = cfg.AddSetting("warn-check-crc-network", nil, []cfg.ValidationFnType{cfg.ValidateBool}, []cfg.SetFn{cfg.SuccessfullyApplied})
 	SkipCheckCrcNetworkActive        = cfg.AddSetting("skip-check-crc-network-active", nil, []cfg.ValidationFnType{cfg.ValidateBool}, []cfg.SetFn{cfg.SuccessfullyApplied})
 	WarnCheckCrcNetworkActive        = cfg.AddSetting("warn-check-crc-network-active", nil, []cfg.ValidationFnType{cfg.ValidateBool}, []cfg.SetFn{cfg.SuccessfullyApplied})
+	SkipCheckCrcBridgePermissions    = cfg.AddSetting("skip-check-crc-network-permissions", nil, []cfg.ValidationFnType{cfg.ValidateBool}, []cfg.SetFn{cfg.SuccessfullyApplied})
+	WarnCheckCrcBridgePermissions    = cfg.AddSetting("warn-check-crc-network-permissions", nil, []cfg.ValidationFnType{cfg.ValidateBool}, []cfg.SetFn{cfg.SuccessfullyApplied})
 	SkipCheckCrcDnsmasqFile          = cfg.AddSetting("skip-check-crc-dnsmasq-file", nil, []cfg.ValidationFnType{cfg.ValidateBool}, []cfg.SetFn{cfg.SuccessfullyApplied})
 	WarnCheckCrcDnsmasqFile          = cfg.AddSetting("warn-check-crc-dnsmasq-file", nil, []cfg.ValidationFnType{cfg.ValidateBool}, []cfg.SetFn{cfg.SuccessfullyApplied})
 	SkipCheckCrcNetworkManagerConfig = cfg.AddSetting("skip-check-network-manager-config", nil, []cfg.ValidationFnType{cfg.ValidateBool}, []cfg.SetFn{cfg.SuccessfullyApplied})

pkg/crc/preflight/preflight_checks_linux.go

@@ -32,6 +32,8 @@ const (
 	crcNetworkManagerConfigFile = "crc-nm-dnsmasq.conf"
 	// This is defined in https://github.com/code-ready/machine-driver-libvirt/blob/master/go.mod#L5
 	minSupportedLibvirtVersion = "3.4.0"
+	qemuBridgeConfigPath       = "/etc/qemu/bridge.conf"
+	qemuBridgeConfigPathRHEL   = "/etc/qemu-kvm/bridge.conf"
 )
 
 var (
@@ -44,6 +46,7 @@ server=/crc.testing/192.168.130.11
 dns=dnsmasq
 `
 	libvirtDriverDownloadURL = fmt.Sprintf("https://github.com/code-ready/machine-driver-libvirt/releases/download/%s/crc-driver-libvirt", libvirtDriverVersion)
+	qemuBridgeConfig         = "allow crc"
 )
 
 func checkVirtualizationEnabled() (bool, error) {
@@ -392,6 +395,53 @@ func fixLibvirtCrcNetworkActive() (bool, error) {
 	return true, nil
 }
 
+func checkLibvirtCrcBridgePermissions() (bool, error) {
+	logging.Debug("Checking if 'crc' bridge has appropriate permissions setup")
+	path := qemuBridgeConfigPath
+	_, err := os.Stat(path)
+	if err != nil {
+		logging.Debug(fmt.Sprintf("Failed to open %s: %s, trying %s..", qemuBridgeConfigPath, err, qemuBridgeConfigPathRHEL))
+		path = qemuBridgeConfigPathRHEL
+		_, err := os.Stat(path)
+		if err != nil {
+			return false, fmt.Errorf("Error opening file: %s: %s", qemuBridgeConfigPathRHEL, err.Error())
+		}
+	}
+	config, err := ioutil.ReadFile(filepath.Clean(path))
+	if err != nil {
+		return false, fmt.Errorf("Error opening file: %s: %s", path, err.Error())
+	}
+	if match, _ := regexp.MatchString(qemuBridgeConfig, string(config)); !match {
+		return false, fmt.Errorf("`crc` network not allowed unprivileged access")
+	}
+	logging.Debug("'crc' bridge has appropriate permissions")
+	return true, nil
+}
+
+func fixLibvirtCrcBridgePermissions() (bool, error) {
+	logging.Debug("Fixing permissions for 'crc'")
+	path := qemuBridgeConfigPath
+	_, err := os.Stat(path)
+	if err != nil {
+		logging.Debug(fmt.Sprintf("Failed to open %s: %s, trying %s..", qemuBridgeConfigPath, err, qemuBridgeConfigPathRHEL))
+		path = qemuBridgeConfigPathRHEL
+		_, err := os.Stat(path)
+		if err != nil {
+			return false, fmt.Errorf("Error opening file: %s: %s", qemuBridgeConfigPathRHEL, err.Error())
+		}
+	}
+	err = crcos.AppendToFileAsRoot(
+		"Allow 'crc' network to be used from session libvirt",
+		fmt.Sprintf("%s\n", qemuBridgeConfig),
+		path,
+	)
+	if err != nil {
+		return false, fmt.Errorf("Failed to write to %s: %v", path, err)
+	}
+	logging.Debug("'crc' bridge now has appropriate permissions")
+	return true, nil
+}
+
 func checkCrcDnsmasqConfigFile() (bool, error) {
 	logging.Debug("Checking dnsmasq configuration")
 	c := []byte(crcDnsmasqConfig)

pkg/crc/preflight/preflight_linux.go

@@ -169,6 +169,12 @@ func SetupHost(vmDriver string) {
 		"Starting libvirt 'crc' network",
 		config.GetBool(cmdConfig.WarnCheckCrcNetworkActive.Name),
 	)
+	preflightCheckAndFix(config.GetBool(cmdConfig.SkipCheckCrcBridgePermissions.Name),
+		checkLibvirtCrcBridgePermissions,
+		fixLibvirtCrcBridgePermissions,
+		"Checking for appropriate permissions on 'crc' network",
+		config.GetBool(cmdConfig.WarnCheckCrcBridgePermissions.Name),
+	)
 	preflightCheckAndFix(config.GetBool(cmdConfig.SkipCheckNetworkManagerInstalled.Name),
 		checkNetworkManagerInstalled,
 		fixNetworkManagerInstalled,