From f986e50de3af35c64e424725c1e695b77dc70426 Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Fri, 12 Dec 2025 04:39:56 +0100 Subject: [PATCH] nixos/virtualbox-guest: Limit access to /dev/vboxuser Permitting all users read-write access to the /dev/vboxuser device is not needed and rather a security issue. So, remove the read-write access to "other" users and only permit access to seat sessions by adding the uaccess tag. Also, since robot-like configurations might depend on the access to this device as well, create the group `vboxuserdev` and change the group ownership of the device accordingly permitting trusted system users access to it. Tested and verified with a graphical session that the VirtualBox guest boots and works. Signed-off-by: Felix Singer --- nixos/modules/virtualisation/virtualbox-guest.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/virtualbox-guest.nix b/nixos/modules/virtualisation/virtualbox-guest.nix index 86197d2e53f5..606f89e8bc81 100644 --- a/nixos/modules/virtualisation/virtualbox-guest.nix +++ b/nixos/modules/virtualisation/virtualbox-guest.nix @@ -131,10 +131,12 @@ in serviceConfig.ExecStart = "@${kernel.virtualboxGuestAdditions}/bin/VBoxService VBoxService --foreground"; }; + users.groups.vboxuserdev = { }; + services.udev.extraRules = '' # /dev/vboxuser is necessary for VBoxClient to work. Maybe we # should restrict this to logged-in users. - KERNEL=="vboxuser", OWNER="root", GROUP="root", MODE="0666" + KERNEL=="vboxuser", OWNER="root", GROUP="vboxuserdev", MODE="0660", TAG+="uaccess" # Allow systemd dependencies on vboxguest. SUBSYSTEM=="misc", KERNEL=="vboxguest", TAG+="systemd"