* Restrict VirtualBox to users in the vboxusers group.

The VirtualBox build in Nixpkgs is insecure because it uses the
  "--disable-hardened" flag, which disables some checks in the
  VirtualBox kernel module.  Since getting rid of that flag looks like
  too much work, it's better to ensure that only explicitly permitted
  users have access to VirtualBox.

* Drop the 666 permission on "sonypi" because it's not clear why that
  device should be world-writable.

svn path=/nixos/trunk/; revision=33301
This commit is contained in:
Eelco Dolstra 2012-03-20 16:30:43 +00:00
parent 11066067f7
commit 010578d8a4
2 changed files with 7 additions and 13 deletions

View file

@ -9,13 +9,11 @@ let virtualbox = config.boot.kernelPackages.virtualbox; in
boot.extraModulePackages = [ virtualbox ];
environment.systemPackages = [ virtualbox ];
# VBoxNetAdpCtl needs to be setuid root to allow users to create
# host-only networks (https://www.virtualbox.org/ticket/4014).
security.setuidOwners = singleton
{ program = "VBoxNetAdpCtl";
source = "${virtualbox}/virtualbox/VBoxNetAdpCtl";
owner = "root";
group = "root";
setuid = true;
};
users.extraGroups = singleton { name = "vboxusers"; };
services.udev.extraRules =
''
KERNEL=="vboxdrv", OWNER="root", GROUP="vboxusers", MODE="0660"
KERNEL=="vboxnetctl", OWNER="root", GROUP="root", MODE="0600"
'';
}

View file

@ -17,12 +17,8 @@ let
nixosRules = ''
# Miscellaneous devices.
KERNEL=="sonypi", MODE="0666"
KERNEL=="kvm", MODE="0666"
KERNEL=="kqemu", MODE="0666"
KERNEL=="vboxdrv", NAME="vboxdrv", OWNER="root", GROUP="root", MODE="0666"
KERNEL=="vboxadd", NAME="vboxadd", OWNER="root", GROUP="root", MODE="0660"
KERNEL=="vboxuser", NAME="vboxuser", OWNER="root", GROUP="root", MODE="0666"
'';
# Perform substitutions in all udev rules files.