"virtualbox: Enable hardening by default" breaks VirtualBox

[4z3]

Commit 3e49487 breaks VirtualBox (at least for users, I haven't tried it as root) by creating files in /root/VirtualBox VMs:

user$ nixos-version 
15.05pre54360.5c52382 (Caterpillar)
user$ VBoxManage createvm --name foo --register
Virtual machine 'foo' is created and registered.
UUID: be27b224-d905-4712-84e7-1aed13496d7e
Settings file: '/root/VirtualBox VMs/foo/foo.vbox'
user$ VBoxManage startvm be27b224-d905-4712-84e7-1aed13496d7e
Waiting for VM "be27b224-d905-4712-84e7-1aed13496d7e" to power on...
VBoxManage: error: The virtual machine 'foo' has terminated unexpectedly during startup with exit code 1 (0x1)
VBoxManage: error: Details: code NS_ERROR_FAILURE (0x80004005), component Machine, interface IMachine

Reverting 3e49487 (as I did in 9dcdeed) yields the expected behavior:

user$ nixos-version 
15.05.git.9dcdeed (Caterpillar)
user$ VBoxManage createvm --name foo --register
Virtual machine 'foo' is created and registered.
UUID: 6c283577-029d-4ede-bf53-0ea00f2266f2
Settings file: '/home/user/VirtualBox VMs/foo/foo.vbox
user$ VBoxManage startvm 6c283577-029d-4ede-bf53-0ea00f2266f2
Waiting for VM "6c283577-029d-4ede-bf53-0ea00f2266f2" to power on...
VM "6c283577-029d-4ede-bf53-0ea00f2266f2" has been successfully started.

In both cases I use following configuration:

user$ grep -i virtualbox /etc/nixos/configuration.nix 
  #services.virtualbox.enable = true;
  services.virtualboxGuest.enable = false;
  services.virtualboxHost.enable = true;

[aszlig]

Geesh, seems to only happen with VBoxManage directly, going to have a look at it later, thanks for reporting.

[ambrop72]

I'm seeing this just by starting VirtualBox. An error dialog with the same text also shows up.

[ambro@nixos:~]$ VirtualBox 
VirtualBox: Error -10 in SUPR3HardenedMain!
VirtualBox: Effective UID is not root (euid=1000 egid=1000 uid=1000 gid=1000)

VirtualBox: Tip! It may help to reinstall VirtualBox.

[aszlig]

@ambrop72: Did you start it using the setuid wrapper? What does type VirtualBox give?

[ambrop72]

Forgot to say that I don't use the virtualbox nixos service. I just:

• Add config.boot.kernelPackages.virtualbox to boot.extraModulePackages and environment.systemPackages.
• Add the vbox kernel module names to boot.kernelModules.
• The udev rules.

I know this is not a supported configuration. But I don't want to use the virtualbox-host nixos service because it uncodnitionally sets up a network interface.

I see that this module does add a setuid wrapper around VirtualBox which I do not have. I'm wondering, why did it work before (4.3.18 I think)?

[aszlig]

Ah, you might want to add config.boot.kernelPackages.virtualbox.override { enableHardening = false; } to extraModulePackages and systemPackages instead.

But since we now have a NixOS module for VirtualBox it might be a good idea to allow disabling the set up of the vboxnet interface.

[ambrop72]

I went with the disabling approach, works okay now, thanks! #5300

[aszlig]

@iElectric: This is not solved yet! Currently working on a fix and a test.

[Fuuzetsu]

My VBox is also broken although I'm not sure if by the commit in question and if even same problem. NS_ERROR_FACTORY_NOT_REGISTERED is given if I try to start it up.

[Fuuzetsu]

FTR my issue was due to some permissions going wrong on /tmp/.vbox-$USER-ipc in case anyone wonders in the future. Removing the file made the problem fix itself.

And pushed fix works for the issue at hand too ;)

[lucabrunox]

I think this is going to be more painful than what it seems. We still don't know if every old virtualbox usage works after the hardening has landed. I suggest to remove virtualbox hardening from 14.12, and let it settle in master for future backport in 14.12 cc @iElectric

[sjau]

Hi there

on current unstable I do now get the same error:

Effective UID is not root (euid=1000 egid=100 uid=1000 gid=100) (rc=-10)

Please try reinstalling VirtualBox.

where: SUPR3HardenedMain what: 2 VERR_PERMISSION_DENIED (-10) - Permission denied. 

In the config I have:

    # Enable Virtualbox
    virtualisation.virtualbox.host.enable = true;
    boot.kernelPackages = pkgs.linuxPackages // {
        virtualbox = pkgs.linuxPackages.virtualbox.override {
            enableExtensionPack = true;
            pulseSupport = true;
        };
    };
    nixpkgs.config.virtualbox.enableExtensionPack = true;

[...]
        extraGroups = [ "networkmanager" "vboxusers" "wheel" "audio" "cdrom" ]; # wheel is for the sudo group

[vcunat]

I suspect it's #22914

[sjau]

Unfortunately #22914 didn,'t help. Sill have the same issue:

17.09pre105060.0a6a06346a (Hummingbird)
nix-env (Nix) 1.11.8
"17.09pre105060.0a6a06346a"

[aszlig]

@sjau: Is this only the case when you're enabling the extension pack?

[sjau]

meanwhile it works again for me.

[vcunat]

Let's close until someone can reproduce it (again).