'/var/run/libvirt/libvirt-sock': Permission denied

[JoyBoy471]

Why am i getting this error:
libvirt: XML-RPC error : Failed to connect socket to '/var/run/libvirt/libvirt-sock': Permission denied
2025-03-25 07:53:26,999 [root] CRITICAL: CuckooCriticalError: Error initializing machines
when i try to run cuckoo.py using this comman:
poetry run python3 cuckoo.py

can you please help with this?

[celyrin]

It looks like the container does not have permission to access /var/run/libvirt/libvirt-sock. You can try running the following commands inside the container:

sudo chown root:libvirt /var/run/libvirt/libvirt-sock
sudo chmod 660 /var/run/libvirt/libvirt-sock

[JoyBoy471]

It looks like the container does not have permission to access /var/run/libvirt/libvirt-sock. You can try running the following commands inside the container:

sudo chown root:libvirt /var/run/libvirt/libvirt-sock
sudo chmod 660 /var/run/libvirt/libvirt-sock

This is the output i get, in my host libvirt group is present but in the container it gives this output:
chown: invalid group: ‘root:libvirt

if i install all the dependencies using sudo and run cuckoo.py its working but...when i try to submit a task via web, i get a log that says connection reset with peers. The analysis gets completed but there is no useful data with the report. The vm gets launched but the sample is not executed inside it. I have installed the agent.py and its running inside the vm , do i need to make some changes with the config files to resolve this?

Is it ok to run with sudo or how can i resolve it.

just got stuck at this point, could you please help me with this.

[celyrin]

I didn't encounter the issue you mentioned when experimenting on Ubuntu 20.04. It’s possible that different host operating systems have different permission controls. Have you tried starting the container with --privileged?

[celyrin]

It looks like the container does not have permission to access /var/run/libvirt/libvirt-sock. You can try running the following commands inside the container:
sudo chown root:libvirt /var/run/libvirt/libvirt-sock
sudo chmod 660 /var/run/libvirt/libvirt-sock

This is the output i get, in my host libvirt group is present but in the container it gives this output: chown: invalid group: ‘root:libvirt

if i install all the dependencies using sudo and run cuckoo.py its working but...when i try to submit a task via web, i get a log that says connection reset with peers. The analysis gets completed but there is no useful data with the report. The vm gets launched but the sample is not executed inside it. I have installed the agent.py and its running inside the vm , do i need to make some changes with the config files to resolve this?

Is it ok to run with sudo or how can i resolve it.

just got stuck at this point, could you please help me with this.

Are you sure the virtual machine started normally after submitting the sample? Could you provide your log file?

[JoyBoy471]

I didn't encounter the issue you mentioned when experimenting on Ubuntu 20.04. It’s possible that different host operating systems have different permission controls. Have you tried starting the container with --privileged?

yes

[JoyBoy471]

after

so after installing all the dependencies using sudo in the container, i used "sudo poetry run python3 cuckoo.py" so this is the log you asked for i think if not correct me:

`2025-03-25 11:03:05,619 [root] INFO: Date set to: 20250325T20:53:32, timeout set to: 200
2025-03-25 20:53:32,438 [root] DEBUG: Starting analyzer from: C:\tmpqz54n6uf
2025-03-25 20:53:32,454 [root] DEBUG: Storing results at: C:\ZQswoaBNpl
2025-03-25 20:53:32,454 [root] DEBUG: Pipe server name: \.\PIPE\zLRdEKz
2025-03-25 20:53:32,454 [root] DEBUG: Python path: C:\Users\cape\AppData\Local\Programs\Python\Python38-32
2025-03-25 20:53:32,454 [root] INFO: analysis running as an admin
2025-03-25 20:53:32,454 [root] INFO: analysis package specified: "pdf"
2025-03-25 20:53:32,454 [root] DEBUG: importing analysis package module: "modules.packages.pdf"...
2025-03-25 20:53:32,485 [root] DEBUG: imported analysis package "pdf"
2025-03-25 20:53:32,485 [root] DEBUG: initializing analysis package "pdf"...
2025-03-25 20:53:32,485 [lib.common.common] INFO: wrapping
2025-03-25 20:53:32,485 [lib.core.compound] INFO: C:\Users\cape\AppData\Local\Temp already exists, skipping creation
2025-03-25 20:53:32,485 [root] DEBUG: New location of moved file: C:\Users\cape\AppData\Local\Temp\2705484648e840fd63cb.pdf
2025-03-25 20:53:32,485 [root] INFO: Analyzer: Package modules.packages.pdf does not specify a DLL option
2025-03-25 20:53:32,485 [root] INFO: Analyzer: Package modules.packages.pdf does not specify a DLL_64 option
2025-03-25 20:53:32,485 [root] INFO: Analyzer: Package modules.packages.pdf does not specify a loader option
2025-03-25 20:53:32,485 [root] INFO: Analyzer: Package modules.packages.pdf does not specify a loader_64 option
2025-03-25 20:53:32,548 [root] DEBUG: Importing auxiliary module "modules.auxiliary.DNS_ETW"...
2025-03-25 20:53:33,595 [modules.auxiliary.DNS_ETW] DEBUG: Could not load auxiliary module DNS_ETW due to 'No module named 'etw''
2025-03-25 20:53:33,610 [root] ERROR: Traceback (most recent call last):
File "C:\tmpqz54n6uf\modules\auxiliary\DNS_ETW.py", line 17, in
from etw import ETW, ProviderInfo
ModuleNotFoundError: No module named 'etw'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "C:/tmpqz54n6uf/analyzer.py", line 1524, in
success = analyzer.run()
File "C:/tmpqz54n6uf/analyzer.py", line 507, in run
import(name, globals(), locals(), ["dummy"])
File "C:\tmpqz54n6uf\modules\auxiliary\DNS_ETW.py", line 22, in
raise CuckooPackageError("In order to use DNS_ETW functionality, it " "is required to have pywintrace setup in python.")
lib.common.exceptions.CuckooPackageError: In order to use DNS_ETW functionality, it is required to have pywintrace setup in python.
Traceback (most recent call last):
File "C:\tmpqz54n6uf\modules\auxiliary\DNS_ETW.py", line 17, in
from etw import ETW, ProviderInfo
ModuleNotFoundError: No module named 'etw'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "C:/tmpqz54n6uf/analyzer.py", line 1524, in
success = analyzer.run()
File "C:/tmpqz54n6uf/analyzer.py", line 507, in run
import(name, globals(), locals(), ["dummy"])
File "C:\tmpqz54n6uf\modules\auxiliary\DNS_ETW.py", line 22, in
raise CuckooPackageError("In order to use DNS_ETW functionality, it " "is required to have pywintrace setup in python.")
lib.common.exceptions.CuckooPackageError: In order to use DNS_ETW functionality, it is required to have pywintrace setup in python.
2025-03-25 20:53:33,610 [root] WARNING: Folder at path "C:\ZQswoaBNpl\debugger" does not exist, skipping
2025-03-25 20:53:33,610 [root] WARNING: Folder at path "C:\ZQswoaBNpl\tlsdump" does not exist, skipping
2025-03-25 20:53:33,610 [root] INFO: Analysis completed
`

im able to use the web with my virb1(ip) 192.168.122.1:8000, im also able to submit files but, it does not give a full report and also the analysis gets completed successfully.

[celyrin]

As you can see in the logs, you need to install pywintrace in the virtual machine; otherwise, the analysis task cannot be completed properly.