c4patino/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-06 17:13:24 -05:00
Code Issues Projects Releases Packages Wiki Activity

nixos/virtualbox-guest: Limit access to /dev/vboxuser

Browse source 
Permitting all users read-write access to the /dev/vboxuser device is
not needed and rather a security issue. So, remove the read-write
access to "other" users and only permit access to seat sessions by
adding the uaccess tag.

Also, since robot-like configurations might depend on the access to
this device as well, create the group `vboxuserdev` and change the group
ownership of the device accordingly permitting trusted system users
access to it.

Tested and verified with a graphical session that the VirtualBox guest
boots and works.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
This commit is contained in:
Felix Singer 2025-12-12 04:39:56 +01:00
commit f986e50de3
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
nixos/modules/virtualisation/virtualbox-guest.nix
View file

@ -131,10 +131,12 @@ in
serviceConfig.ExecStart = "@${kernel.virtualboxGuestAdditions}/bin/VBoxService VBoxService --foreground";
};
users.groups.vboxuserdev = { };
services.udev.extraRules = ''
# /dev/vboxuser is necessary for VBoxClient to work. Maybe we
# should restrict this to logged-in users.
KERNEL=="vboxuser", OWNER="root", GROUP="root", MODE="0666"
KERNEL=="vboxuser", OWNER="root", GROUP="vboxuserdev", MODE="0660", TAG+="uaccess"
# Allow systemd dependencies on vboxguest.
SUBSYSTEM=="misc", KERNEL=="vboxguest", TAG+="systemd"