nordic-dev.net/nixpkgs
nordic-dev.net/nixpkgs
2
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-17 11:13:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

* Restrict VirtualBox to users in the vboxusers group.

Browse Source 
The VirtualBox build in Nixpkgs is insecure because it uses the
  "--disable-hardened" flag, which disables some checks in the
  VirtualBox kernel module.  Since getting rid of that flag looks like
  too much work, it's better to ensure that only explicitly permitted
  users have access to VirtualBox.

* Drop the 666 permission on "sonypi" because it's not clear why that
  device should be world-writable.

svn path=/nixos/trunk/; revision=33301
This commit is contained in:
Eelco Dolstra 2012-03-20 16:30:43 +00:00
parent 11066067f7
commit 010578d8a4
2 changed files with 7 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
modules/programs/virtualbox.nix
View File

@ -9,13 +9,11 @@ let virtualbox = config.boot.kernelPackages.virtualbox; in
boot.extraModulePackages = [ virtualbox ];
environment.systemPackages = [ virtualbox ];
# ‘VBoxNetAdpCtl’ needs to be setuid root to allow users to create
# host-only networks (https://www.virtualbox.org/ticket/4014).
security.setuidOwners = singleton
{ program = "VBoxNetAdpCtl";
source = "${virtualbox}/virtualbox/VBoxNetAdpCtl";
owner = "root";
group = "root";
setuid = true;
};
users.extraGroups = singleton { name = "vboxusers"; };
services.udev.extraRules =
''
KERNEL=="vboxdrv", OWNER="root", GROUP="vboxusers", MODE="0660"
KERNEL=="vboxnetctl", OWNER="root", GROUP="root", MODE="0600"
'';
}

4
modules/services/hardware/udev.nix
View File

@ -17,12 +17,8 @@ let
nixosRules = ''
# Miscellaneous devices.
KERNEL=="sonypi", MODE="0666"
KERNEL=="kvm", MODE="0666"
KERNEL=="kqemu", MODE="0666"
KERNEL=="vboxdrv", NAME="vboxdrv", OWNER="root", GROUP="root", MODE="0666"
KERNEL=="vboxadd", NAME="vboxadd", OWNER="root", GROUP="root", MODE="0660"
KERNEL=="vboxuser", NAME="vboxuser", OWNER="root", GROUP="root", MODE="0666"
'';
# Perform substitutions in all udev rules files.