movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-14 06:00:33 +03:00
Code Activity

nixos/virtualbox-host: Fix hardening with headless vbox

Browse source 
Fixes #157157.
This commit is contained in:
Zhaofeng Li 2022-10-08 15:41:17 -06:00
parent f677051b8d
commit 6ed7e545ec
1 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nixos/modules/virtualisation/virtualbox-host.nix
View file

@ -104,16 +104,18 @@ in
group = "vboxusers"; group = "vboxusers";
setuid = true; setuid = true;
}; };
in mkIf cfg.enableHardening executables = [
(builtins.listToAttrs (map (x: { name = x; value = mkSuid x; }) [
"VBoxHeadless" "VBoxHeadless"
"VBoxNetAdpCtl" "VBoxNetAdpCtl"
"VBoxNetDHCP" "VBoxNetDHCP"
"VBoxNetNAT" "VBoxNetNAT"
"VBoxSDL"
"VBoxVolInfo" "VBoxVolInfo"
] ++ (lib.optionals (!cfg.headless) [
"VBoxSDL"
"VirtualBoxVM" "VirtualBoxVM"
])); ]);
in mkIf cfg.enableHardening
(builtins.listToAttrs (map (x: { name = x; value = mkSuid x; }) executables));
users.groups.vboxusers.gid = config.ids.gids.vboxusers; users.groups.vboxusers.gid = config.ids.gids.vboxusers;