setting cap via pam to virsh

[DaggyStyle]

Greetings,

as part of sessioned virsh, I need to create a tap interface but I'm unable due to permissions. I get this error: "Unable to create tap device Operation not permitted"
I've took out the relevant code and placed it in a c file, compiled and got a bin that tries to create a tap.
next, I've went to configure pam_cap as follows:

1. created a file at /etc/pam.d/test1 and added this to the file: auth required pam_cap.so
   
2. set the cap with this command: setcap cap_net_admin+eip test1
   

and I ran test1, it worked.
now I went to define the same for virsh, e,g,

1. created a file at /etc/pam.d/virsh and added this to the file: auth required pam_cap.so
   
2. set the cap with this command: setcap cap_net_admin+eip $(which virsh)
   

and ran run virsh -c qemu:///session start <vm>, I'm still getting the error above. I assume that it is because the creation gets executed in a thread but afaik, the i in setcap takes cares of it,
what am I missing?
_________________
Only two things are infinite, the universe and human stupidity and I'm not sure about the former - Albert Einstein

[salahx]

That's because virsh doesn't actually create the tap. virsh just a command-line wrapper for the dbus API. What you want to is give permissions to helper qemu uses to create bridge and tap devices. That helper is /usr/libexec/qemu-bridge-helper .

[DaggyStyle]