Motivation for this change

Currently if libvirtd module is enabled anyone can access libvirtd socket (not only read only), since sockets has wide read and write permissions. This is by design, since in most distros polkit is enabled and polkit does auth/authz checks. In nixos (polkit) auth was disabled and it was thought security was enforced by unix_sock_rw_perms, but it was not, since sockets were created by systemd with wide open permissions.

Anyway, enabling polkit authorization fixes all that and enables additional rules to be created. A default rule is that anyone with access to libvirtd group has access to libvirt, which is the same as in other distros.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.