[Guide] How to install virt-viewer with USB redirection support

General
1

If you are a Proxmox homelabber like me and work with virtual machines, you know that SPICE protocol (used by QEMU/Libvirt) is one of the most popular and feature rich besides RDP and VNC to connect to your virtual machines remotely and access to your local storage devices without the need to passthrough HW directly. (For a detailed guide on how to configure spice in your Proxmox VM please check here)

One of the downsides of getting virt-viewer from flathub is that currently there is no support for USB redirection. Only basic functionality to connect.

And layering packages in the image is discouraged, so our alternative is to configure a distrobox container. Here is how:

Steps:

1. Create a rootful container.
In this case I’ll use an Arch based container with the ublue image to provide the most recent version of the spice client. In my case I added a flag to mount a volume where my automatic drives are mounted at boot.
Command:

 distrobox-create --pull --init --nvidia --root --image ghcr.io/ublue-os/arch-distrobox  --name arch-privileged --volume /media/system

2. Export the container .desktop shortcut.

distrobox generate-entry arch-privileged

You will see a new entry in your menu after a couple of seconds.

3. Enter to the container and set a root password.

distrobox enter --root arch-privileged

Wait until the container finishes the initial setup, then it will give you a prompt where you have to set a root password for the container.

4. Upgrade the packages and repo database.
Note: In this step you have to use the root password configured for the container for sudo commands, not your own host system password.

sudo pacman -Syu --noconfirm

5. Install the necessary packages.
You can switch nano to another cli text editor since arch doesn’t provide any by default.

sudo pacman -S --noconfirm nano polkit virt-viewer

6. Edit polkit rules for USB access.
This step is crucial to get the USB redirection working inside the container. Thanks to OpenSUSE folks for the tip. Source

You have to edit /usr/share/polkit-1/actions/org.spice-space.lowlevelusbaccess.policy with sudo inside the container and set the following directives:

<allow_any>yes</allow_any>
<allow_inactive>yes</allow_inactive>

Then the file will look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
          "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
          "http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>

  <vendor>The Spice Project</vendor>
  <vendor_url>http://spice-space.org/</vendor_url>
  <icon_name>spice</icon_name>

  <action id="org.spice-space.lowlevelusbaccess">
    <description>Low level USB device access</description>
    <message>Privileges are required for low level USB device access (for usb device pass through).</message>
    <defaults>
      <allow_any>yes</allow_any>
      <allow_inactive>yes</allow_inactive>
      <allow_active>yes</allow_active>
    </defaults>
  </action>

</policyconfig>

Save the file and exit.

7. Export the app shortcut.
Inside the container execute:

distrobox-export --app remote-viewer

8. Test it.
Now is time to test the connection and USB stuff.
Start a Proxmox VM and click the spice console type, then the browser will download a file named “pve-spice.vv”

Now click in the file and select the exported “Remote-viewer” app, then it will show a promt asking for a password one or two times depending if the container is stopped. In this case you need to use your host system sudo password.

If it fails to connect you have to:

  • Redownload the file, select it from the file explorer and select the option “Open with” then click the remote-viewer.
  • Or launch the remote-viewer and type the full path of the file without spaces, then try to connect.

Once you are connected for the first time in Gnome, you have to grant other permissions.

Login into your VM and connect a USB device, then click the USB button at the top of the remote-viewer window, and select your preferred USB device.

Accessing the USB:

image
image1880Ă—1043 104 KB

To mount a disk via webdav spice service, click the three dots and in preferences select your disk/folder, then click in “Share folder” checkbox.

(If the folder is not showing you need to manually start the spice-webdav service in Windows and reconnect the client, then repeat the step to mount the folder).

And thats all for now, I hope this guide help some homelabbers who use an Ublue OS :grin:.

3 Likes