Run qemu instances as qemu-libvirt instead of root by default

debian/libvirt-bin.postinst

@@ -24,6 +24,25 @@ case "$1" in
     		addgroup --system libvirt
 	fi
 
+	# user and group libvirt runs qemu/kvm instances with
+	if ! getent group libvirt-qemu >/dev/null; then
+		addgroup --system libvirt-qemu
+	fi
+	if ! getent passwd libvirt-qemu >/dev/null; then
+		adduser --system \
+			--ingroup libvirt-qemu \
+			--quiet \
+			--disabled-login \
+			--disabled-password \
+                        --home /var/lib/libvirt \
+                        --no-create-home \
+			-gecos "Libvirt Qemu" \
+			libvirt-qemu
+		if getent group kvm >/dev/null; then
+			adduser libvirt-qemu kvm
+		fi
+	fi
+
 	# libvirt from 0.6.0 on is safe to restart with running vms:
 	if [ -n "$2" ] &&  dpkg --compare-versions "$2" ge 0.6.0; then
 	    if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then

debian/rules

@@ -24,6 +24,8 @@ include /usr/share/cdbs/1/rules/patchsys-quilt.mk
 DEB_CONFIGURE_EXTRA_FLAGS :=     \
 	--disable-rpath          \
 	--with-qemu              \
+	--with-qemu-user=libvirt-qemu  \
+	--with-qemu-group=libvirt-qemu \
 	--with-openvz            \
 	--with-avahi             \
 	--with-sasl              \