How can I provide network access to a mkosi built Arch linux ?

[ssooffiiaannee]

I have built an arch linux distribution.
Built with the following :

cd systemd
mkosi -f genkey
mkosi -d arch -r release
mkosi build

I provided the qemuArgs to mkosi/mkosi.conf :

QemuArgs=-netdev bridge,id=net0,br=br-vm-mkosi 
        -device virtio-net-pci,netdev=net0

mkosi -d arch -r release summary shows that the arguments are taken into account.

# summary
QEMU Extra Arguments: -netdev
                     bridge,id=net0,br=br-vm-mkosi
                     -device
                     virtio-net-pci,netdev=net0

mkosi vm : Error :

 Using selector: EpollSelector
failed to parse default acl file `/etc/qemu/bridge.conf'
qemu-system-x86_64: -netdev bridge,id=net0,br=br-vm-mkosi: bridge helper failed
‣ "/usr/bin/qemu-system-x86_64 -machine type=q35,smm=on,memory-backend=mem,hpet=off -smp 2 -m 2048M -object rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0,id=rng-device0 -device virtio-balloon,free-page-reporting=on -no-user-config -object memory-backend-memfd,id=mem,size=2048M,share=on -nic user,model=virtio-net-pci --add-fd fd=3,set=1,opaque=/dev/kvm -cpu host -accel kvm,device=/dev/fdset/1 -device vhost-vsock-pci,guest-cid=1327240723,vhostfd=4 -nographic -nodefaults -chardev stdio,mux=on,id=console,signal=off -device virtio-serial-pci,id=mkosi-virtio-serial-pci -device virtconsole,chardev=console -mon console -drive if=pflash,format=raw,readonly=on,file=/usr/share/OVMF/OVMF_CODE_4M.secboot.fd -drive file=/tmp/mkosi-ovmf-vars-y3u6zav2,if=pflash,format=raw -global ICH9-LPC.disable_s3=1 -global driver=cfi.pflash01,property=secure,value=on -chardev socket,id=sock-274cdfee0cbd4b4181b13dccdf7c4ae7,path=/tmp/mkosi-virtiofsd-35xn70i8/sock-274cdfee0cbd4b4181b13dccdf7c4ae7 -device vhost-user-fs-pci,queue-size=1024,chardev=sock-274cdfee0cbd4b4181b13dccdf7c4ae7,tag=/work/src -chardev socket,id=sock-b5459431389946e79148b0915f27330a,path=/tmp/mkosi-virtiofsd-mvsfo50j/sock-b5459431389946e79148b0915f27330a -device vhost-user-fs-pci,queue-size=1024,chardev=sock-b5459431389946e79148b0915f27330a,tag=/work/build -device virtio-scsi-pci,id=mkosi -blockdev driver=raw,node-name=mkosi,discard=unmap,file.driver=file,file.filename=/home/soham/Desktop/yocto_exp/systemd_container/systemd/build/mkosi.output/image.raw,file.aio=io_uring,cache.direct=yes,cache.no-flush=no -device virtio-blk-pci,drive=mkosi,bootindex=1 -chardev socket,id=chrtpm,path=/tmp/mkosi-swtpm-6ba6h_sl/sock -tpmdev emulator,id=tpm0,chardev=chrtpm -device tpm-tis,tpmdev=tpm0 -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/tty.serial.hvc0.login.noauth -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/tty.console.agetty.autologin -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/keyfile -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/userdb.group.testuser -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/firstboot.locale -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/vmm.notify_socket -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/tty.console.login.noauth -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/tty.virtual.tty1.login.noauth -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/firstboot.timezone -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/ssh.authorized_keys.root -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/tty.virtual.tty1.agetty.autologin -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/journal.storage -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/fstab.extra -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/userdb.user.testuser -smbios type=11,path=/tmp/mkosi-smbios-blj85wa_/tty.serial.hvc0.agetty.autologin -smbios 'type=11,value=io.systemd.stub.kernel-cmdline-extra=rw systemd.wants=network.target module_blacklist=vmw_vmci systemd.tty.term.hvc0=xterm-256color systemd.tty.columns.hvc0=151 systemd.tty.rows.hvc0=39 ip=enc0:any ip=enp0s1:any ip=enp0s2:any ip=host0:any ip=none loglevel=4 SYSTEMD_SULOGIN_FORCE=1 systemd.tty.term.console=xterm-256color systemd.tty.columns.console=151 systemd.tty.rows.console=39 console=hvc0 TERM=xterm-256color' -smbios 'type=11,value=io.systemd.boot.kernel-cmdline-extra=rw systemd.wants=network.target module_blacklist=vmw_vmci systemd.tty.term.hvc0=xterm-256color systemd.tty.columns.hvc0=151 systemd.tty.rows.hvc0=39 ip=enc0:any ip=enp0s1:any ip=enp0s2:any ip=host0:any ip=none loglevel=4 SYSTEMD_SULOGIN_FORCE=1 systemd.tty.term.console=xterm-256color systemd.tty.columns.console=151 systemd.tty.rows.console=39 console=hvc0 TERM=xterm-256color' -netdev bridge,id=net0,br=br-vm-mkosi -device virtio-net-pci,netdev=net0" returned non-zero exit code 1.
‣ Sandbox command: mkosi-sandbox --bind /proc /proc --unsetenv TMPDIR --setenv SYSTEMD_OFFLINE 1 --ro-bind /home/soham/Desktop/yocto_exp/systemd_container/systemd/mkosi.tools/usr /usr --ro-bind /home/soham/Desktop/yocto_exp/systemd_container/systemd/mkosi.tools/opt /opt --symlink usr/bin /bin --symlink usr/sbin /sbin --symlink usr/lib /lib --symlink usr/lib32 /lib32 --symlink usr/lib64 /lib64 --bind /lost+found /lost+found --bind /root /root --bind /run /run --bind /var /var --bind /sbin.usr-is-merged /sbin.usr-is-merged --bind /swap.img /swap.img --bind /boot /boot --bind /media /media --bind /lib.usr-is-merged /lib.usr-is-merged --bind /bin.usr-is-merged /bin.usr-is-merged --bind /tmp /tmp --bind /mnt /mnt --bind /home /home --bind /srv /srv --bind /dev /dev --symlink usr/libx32 /libx32 --bind /snap /snap --bind /cdrom /cdrom --bind /sys /sys --ro-bind /home/soham/Desktop/yocto_exp/systemd_container/systemd/mkosi.tools/etc /etc --ro-bind /etc/passwd /etc/passwd --ro-bind /etc/group /etc/group --ro-bind /etc/shadow /etc/shadow --ro-bind /etc/gshadow /etc/gshadow --ro-bind /etc/nsswitch.conf /etc/nsswitch.conf --ro-bind /etc/machine-id /etc/machine-id --ro-bind /etc/resolv.conf /etc/resolv.conf --setenv PATH /home/soham/Desktop/yocto_exp/systemd_container/systemd/build:/home/soham/.local/share/pnpm:/home/soham/.local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin:/home/soham/Downloads/gcc-linaro-7.5.0-2019.12-x86_64_arm-linux-gnueabihf/bin:/home/soham/Downloads/clion-2025.1.2/bin --dir /etc --same-dir

failed to parse default acl file /etc/qemu/bridge.conf error shows up.

I made sure to give suid permission to helper file:
sudo chmod u+s /usr/lib/qemu/qemu-bridge-helper
And bridge.conf allows the bridge :

$ cat /etc/qemu/bridge.conf
allow br-vm-mkosi

Note that I tested this network setup with qemu-system-x86_64 + arch linux iso image, I had not problem booting the image.

[MoltenArmor]

I don't think this question is related to mkosi. You can refer to systemd-networkd for network configuration.

[daandemeyer]

suid helpers will never work with mkosi. I recommend you use mkosi's Network= option or start the vm without mkosi.

[ssooffiiaannee]

Did you mean RuntimeNetwork= option ?

I tested it, RuntimeNetwork=interface it requires root pervileges :

mkosi vm                        ==> ‣ RuntimeNetwork=interface requires root privileges`
sudo mkosi vm              ==>  sudo mkosi command not found
sudo env PATH=$PATH mkosi vm                ==> permission error (explained below)

After this I hit the permission error :

  File "/home/soham/Desktop/yocto_exp/systemd_container/mkosi/mkosi/sandbox.py", line 603, in become_user
    raise OSError(rc, os.strerror(rc))
PermissionError: [Errno 13] Permission denied

strace shows prlimit64 syscall permission error

So I temporary set capabilities of python binary to solve the previous permission denied error:

/usr/bin/python cap_sys_admin,cap_sys_resource=ep
Yet other issues with accessing : mkosi/mkosi.credentials/keyfile", X_OK) = -1 EACCES (Permission denied), user owned

-rw-r--r-- 1 soham 10000 5 Feb 1 19:34 mkosi/mkosi.credentials/keyfile

Any other way I can configure RuntimeNetwork ?