Unverified Commit 719e86cc authored by Michael Daniels's avatar Michael Daniels Committed by GitHub
Browse files

nixos/virtualbox-guest: Limit access to /dev/vboxuser (#470050)

parents 62a71f1f f986e50d

nixos/modules/virtualisation/virtualbox-guest.nix

+3 −1
Original line number Diff line number Diff line
@@ -131,10 +131,12 @@ in 
          serviceConfig.ExecStart = "@${kernel.virtualboxGuestAdditions}/bin/VBoxService VBoxService --foreground";

        };



        users.groups.vboxuserdev = { };



        services.udev.extraRules = ''

          # /dev/vboxuser is necessary for VBoxClient to work.  Maybe we

          # should restrict this to logged-in users.

          KERNEL=="vboxuser",  OWNER="root", GROUP="root", MODE="0666"

          KERNEL=="vboxuser",  OWNER="root", GROUP="vboxuserdev", MODE="0660", TAG+="uaccess"



          # Allow systemd dependencies on vboxguest.

          SUBSYSTEM=="misc", KERNEL=="vboxguest", TAG+="systemd"