Permission errors when running Lima on Ubuntu host. (Could not access KVM kernel module: Permission denied)

[hylowaker]

I'm using Ubuntu as host and trying to launch Rocky as guest.

However, I get errors from QEMU when I try to start the VM: Could not access KVM kernel module: Permission denied. Lima does not allow to be started as root. What am I missing?

Terminal logs:

$ limactl create --name=test-rocky1 template://rocky-8
? Creating an instance "test-rocky1" Open an editor to review or modify the current configuration
INFO[0004] Attempting to download the image              arch=x86_64 digest="sha256:e56066c58606191e96184de9a9183a3af33c59bcbd8740d8b10ca054a7a89c14" location="https://dl.rockylinux.org/pub/rocky/8.10/images/x86_64/Rocky-8-GenericCloud-Base-8.10-20240528.0.x86_64.qcow2"
INFO[0005] Using cache "/home/jaeheunghan/.cache/lima/download/by-url-sha256/9db79833f858a060e012b5617c9714005222dc3c9b60ed1559a270423d47dc0f/data" 
INFO[0005] Attempting to download the nerdctl archive    arch=x86_64 digest="sha256:2c841e097fcfb5a1760bd354b3778cb695b44cd01f9f271c17507dc4a0b25606" location="https://github.com/containerd/nerdctl/releases/download/v1.7.6/nerdctl-full-1.7.6-linux-amd64.tar.gz"
INFO[0005] Using cache "/home/jaeheunghan/.cache/lima/download/by-url-sha256/b86908f1f5ea2af45aec405f0fd389eba1999b51e3972ca78215ace94d2da2a6/data" 
INFO[0005] Run `limactl start test-rocky1` to start the instance.

$ limactl start test-rocky1
INFO[0000] Using the existing instance "test-rocky1"    
INFO[0000] Starting the instance "test-rocky1" with VM driver "qemu" 
INFO[0000] [hostagent] hostagent socket created at /home/jaeheunghan/.lima/test-rocky1/ha.sock 
INFO[0000] [hostagent] Using system firmware ("/usr/share/OVMF/OVMF_CODE.fd") 
INFO[0000] [hostagent] Starting QEMU (hint: to watch the boot progress, see "/home/jaeheunghan/.lima/test-rocky1/serial*.log") 
INFO[0001] SSH Local Port: 43683                        
INFO[0000] [hostagent] Waiting for the essential requirement 1 of 4: "ssh" 
INFO[0000] [hostagent] Driver stopped due to error: "exit status 1" 
INFO[0000] [hostagent] Shutting down the host agent     
WARN[0000] [hostagent] failed to exit SSH master         error="failed to execute `ssh -O exit -p 43683 127.0.0.1`, out=\"Control socket connect(/home/jaeheunghan/.lima/test-rocky1/ssh.sock): No such file or directory\\r\\n\": exit status 255"
INFO[0000] [hostagent] Shutting down QEMU with ACPI     
WARN[0000] [hostagent] failed to open the QMP socket "/home/jaeheunghan/.lima/test-rocky1/qmp.sock", forcibly killing QEMU  error="dial unix /home/jaeheunghan/.lima/test-rocky1/qmp.sock: connect: connection refused"
INFO[0000] [hostagent] QEMU has already exited          
FATA[0001] exiting, status={Running:false Degraded:false Exiting:true Errors:[] SSHLocalPort:0} (hint: see "/home/jaeheunghan/.lima/test-rocky1/ha.stderr.log") 

$ sudo limactl start test-rocky1
FATA[0000] must not run as the root user

$ cat /home/jaeheunghan/.lima/test-rocky1/ha.stderr.log
{"level":"debug","msg":"Creating iso file /home/jaeheunghan/.lima/test-rocky1/cidata.iso","time":"2024-09-23T08:11:11Z"}
{"level":"debug","msg":"Using /tmp/diskfs_iso856060825 as workspace","time":"2024-09-23T08:11:11Z"}
{"level":"debug","msg":"OpenSSH version 8.2.1 detected","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"AES accelerator seems available, prioritizing aes128-gcm@openssh.com and aes256-gcm@openssh.com","time":"2024-09-23T08:11:12Z"}
{"level":"info","msg":"hostagent socket created at /home/jaeheunghan/.lima/test-rocky1/ha.sock","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"Start udp DNS listening on: 127.0.0.1:48852","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"Start tcp DNS listening on: 127.0.0.1:40559","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"QEMU version 4.2.1 detected","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"firmware candidates = [/home/jaeheunghan/.local/share/qemu/edk2-x86_64-code.fd /usr/share/qemu/edk2-x86_64-code.fd /usr/share/OVMF/OVMF_CODE.fd /usr/share/OVMF/OVMF_CODE_4M.fd /usr/share/edk2/ovmf/OVMF_CODE.fd /usr/share/qemu/ovmf-x86_64-code.bin /usr/share/edk2-ovmf/x64/OVMF_CODE.fd]","time":"2024-09-23T08:11:12Z"}
{"level":"info","msg":"Using system firmware (\"/usr/share/OVMF/OVMF_CODE.fd\")","time":"2024-09-23T08:11:12Z"}
{"level":"info","msg":"Starting QEMU (hint: to watch the boot progress, see \"/home/jaeheunghan/.lima/test-rocky1/serial*.log\")","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"qCmd.Args: [/usr/bin/qemu-system-x86_64 -m 4096 -cpu Haswell-v4 -machine q35,accel=kvm -smp 4,sockets=1,cores=4,threads=1 -drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF_CODE.fd -boot order=c,splash-time=0,menu=on -drive file=/home/jaeheunghan/.lima/test-rocky1/diffdisk,if=virtio,discard=on -drive id=cdrom0,if=none,format=raw,readonly=on,file=/home/jaeheunghan/.lima/test-rocky1/cidata.iso -device virtio-scsi-pci,id=scsi0 -device scsi-cd,bus=scsi0.0,drive=cdrom0 -netdev user,id=net0,net=192.168.5.0/24,dhcpstart=192.168.5.15,hostfwd=tcp:127.0.0.1:33027-:22 -device virtio-net-pci,netdev=net0,mac=52:55:55:97:f4:f2 -device virtio-rng-pci -display none -device virtio-vga -device virtio-keyboard-pci -device virtio-mouse-pci -device qemu-xhci,id=usb-bus -parallel none -chardev socket,id=char-serial,path=/home/jaeheunghan/.lima/test-rocky1/serial.sock,server=on,wait=off,logfile=/home/jaeheunghan/.lima/test-rocky1/serial.log -serial chardev:char-serial -chardev socket,id=char-serial-virtio,path=/home/jaeheunghan/.lima/test-rocky1/serialv.sock,server=on,wait=off,logfile=/home/jaeheunghan/.lima/test-rocky1/serialv.log -device virtio-serial-pci,id=virtio-serial0,max_ports=1 -device virtconsole,chardev=char-serial-virtio,id=console0 -chardev socket,id=char-qmp,path=/home/jaeheunghan/.lima/test-rocky1/qmp.sock,server=on,wait=off -qmp chardev:char-qmp -chardev socket,path=/home/jaeheunghan/.lima/test-rocky1/ga.sock,server=on,wait=off,id=qga0 -device virtio-serial -device virtserialport,chardev=qga0,name=io.lima-vm.guest_agent.0 -name lima-test-rocky1 -pidfile /home/jaeheunghan/.lima/test-rocky1/qemu.pid]","time":"2024-09-23T08:11:12Z"}
{"level":"info","msg":"Waiting for the essential requirement 1 of 4: \"ssh\"","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"executing script \"ssh\"","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"executing ssh for script \"ssh\": /usr/bin/ssh [ssh -F /dev/null -o IdentityFile=\"/home/jaeheunghan/.lima/_config/user\" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o NoHostAuthenticationForLocalhost=yes -o GSSAPIAuthentication=no -o PreferredAuthentications=publickey -o Compression=no -o BatchMode=yes -o IdentitiesOnly=yes -o Ciphers=\"^aes128-gcm@openssh.com,aes256-gcm@openssh.com\" -o User=jaeheunghan -o ControlMaster=auto -o ControlPath=\"/home/jaeheunghan/.lima/test-rocky1/ssh.sock\" -o ControlPersist=yes -p 33027 127.0.0.1 -- /bin/bash]","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"stdout=\"\", stderr=\"ssh: connect to host 127.0.0.1 port 33027: Connection refused\\r\\n\", err=failed to execute script \"ssh\": stdout=\"\", stderr=\"ssh: connect to host 127.0.0.1 port 33027: Connection refused\\r\\n\": exit status 255","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"qemu[stderr]: Could not access KVM kernel module: Permission denied","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"qemu[stderr]: qemu-system-x86_64: failed to initialize KVM: Permission denied","time":"2024-09-23T08:11:12Z"}
{"level":"info","msg":"Driver stopped due to error: \"exit status 1\"","time":"2024-09-23T08:11:12Z"}
{"level":"info","msg":"Shutting down the host agent","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"shutting down the SSH master","time":"2024-09-23T08:11:12Z"}
{"level":"debug","msg":"executing ssh for exiting the master: /usr/bin/ssh [ssh -F /dev/null -o IdentityFile=\"/home/jaeheunghan/.lima/_config/user\" -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o NoHostAuthenticationForLocalhost=yes -o GSSAPIAuthentication=no -o PreferredAuthentications=publickey -o Compression=no -o BatchMode=yes -o IdentitiesOnly=yes -o Ciphers=\"^aes128-gcm@openssh.com,aes256-gcm@openssh.com\" -o User=jaeheunghan -o ControlMaster=auto -o ControlPath=\"/home/jaeheunghan/.lima/test-rocky1/ssh.sock\" -o ControlPersist=yes -O exit -p 33027 127.0.0.1]","time":"2024-09-23T08:11:12Z"}
{"error":"failed to execute `ssh -O exit -p 33027 127.0.0.1`, out=\"Control socket connect(/home/jaeheunghan/.lima/test-rocky1/ssh.sock): No such file or directory\\r\\n\": exit status 255","level":"warning","msg":"failed to exit SSH master","time":"2024-09-23T08:11:12Z"}
{"level":"info","msg":"Shutting down QEMU with ACPI","time":"2024-09-23T08:11:12Z"}
{"error":"dial unix /home/jaeheunghan/.lima/test-rocky1/qmp.sock: connect: connection refused","level":"warning","msg":"failed to open the QMP socket \"/home/jaeheunghan/.lima/test-rocky1/qmp.sock\", forcibly killing QEMU","time":"2024-09-23T08:11:12Z"}
{"level":"info","msg":"QEMU has already exited","time":"2024-09-23T08:11:12Z"}

$ qemu-system-x86_64 --version
QEMU emulator version 4.2.1 (Debian 1:4.2-3ubuntu6.29)
Copyright (c) 2003-2019 Fabrice Bellard and the QEMU Project developers

$ cat /etc/*release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.6 LTS"
NAME="Ubuntu"
VERSION="20.04.6 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.6 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

[afbjorklund]

There are some hints at https://help.ubuntu.com/community/KVM/Installation (like enabling VT-x/AMD-V in BIOS)

$ kvm-ok
INFO: /dev/kvm exists
KVM acceleration can be used

[afbjorklund]

I think previously you had to be a member of the "kvm" group, but I don't know if that still applies or not.

crw-rw----+ 1 root kvm 10, 232 Sep 23 15:46 /dev/kvm