From 3e49487c1a3289acdb72c15e7a6d6105070dd420 Mon Sep 17 00:00:00 2001 From: aszlig Date: Sat, 29 Nov 2014 08:09:50 +0100 Subject: virtualbox: Enable hardening by default. VirtualBox with hardening support requires the main binaries to be setuid root. Using VBOX_WITH_RUNPATH, we ensure that the RPATHs are pointing to the libexec directory and we also need to unset VBOX_WITH_ORIGIN to make sure that the build system is actually setting those RPATHs. The hardened.patch implements two things: * Set the binary directory to the setuid-wrappers dir so that VboxSVC calls them instead of the binaries from the store path. The reason behind this is because nothing in the Nix store can have the setuid flag. * Excempt /nix/store from the group permission check, because while it is group-writeable indeed it also has the sticky bit set (and also the whole store is mounted read-only on most NixOS systems), so we're checking on that as well. Right now, the hardened.patch uses /nix/store and /var/setuid-wrappers directly, so someone would ever want to change those on a NixOS system, please provide a patch to set those paths on build time. However, for simplicity, it's best to do it when we _really_ need it. Signed-off-by: aszlig --- nixos/modules/programs/virtualbox-host.nix | 16 ++++++++++ .../virtualization/virtualbox/default.nix | 34 +++++++++++++++------- .../virtualization/virtualbox/hardened.patch | 26 +++++++++++++++++ 3 files changed, 65 insertions(+), 11 deletions(-) create mode 100644 pkgs/applications/virtualization/virtualbox/hardened.patch diff --git a/nixos/modules/programs/virtualbox-host.nix b/nixos/modules/programs/virtualbox-host.nix index d32ebc7ebcb6..ea962d5d6cee 100644 --- a/nixos/modules/programs/virtualbox-host.nix +++ b/nixos/modules/programs/virtualbox-host.nix @@ -16,6 +16,22 @@ in boot.extraModulePackages = [ virtualbox ]; environment.systemPackages = [ virtualbox ]; + security.setuidOwners = let + mkVboxStub = program: { + inherit program; + owner = "root"; + group = "vboxusers"; + setuid = true; + }; + in map mkVboxStub [ + "VBoxBFE" + "VBoxBalloonCtrl" + "VBoxHeadless" + "VBoxManage" + "VBoxSDL" + "VirtualBox" + ]; + users.extraGroups.vboxusers.gid = config.ids.gids.vboxusers; services.udev.extraRules = diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix index 1eca32bb6637..a188d6620960 100644 --- a/pkgs/applications/virtualization/virtualbox/default.nix +++ b/pkgs/applications/virtualization/virtualbox/default.nix @@ -6,6 +6,7 @@ , pythonBindings ? false, python ? null , enableExtensionPack ? false, requireFile ? null, patchelf ? null , pulseSupport ? false, pulseaudio ? null +, enableHardening ? true }: with stdenv.lib; @@ -83,28 +84,39 @@ in stdenv.mkDerivation { set +x ''; + patches = optional enableHardening ./hardened.patch; + configurePhase = '' sourcedir="$(pwd)" + cat >> LocalConfig.kmk <> AutoConfig.kmk << END_PATHS - VBOX_PATH_APP_PRIVATE := $out - VBOX_PATH_APP_DOCS := $out/doc - ${optionalString javaBindings '' - VBOX_JAVA_HOME := ${jdk} - ''} - END_PATHS - echo "VBOX_WITH_DOCS :=" >> LocalConfig.kmk - echo "VBOX_WITH_WARNINGS_AS_ERRORS :=" >> LocalConfig.kmk ''; enableParallelBuilding = true; diff --git a/pkgs/applications/virtualization/virtualbox/hardened.patch b/pkgs/applications/virtualization/virtualbox/hardened.patch new file mode 100644 index 000000000000..b789ddbeacbd --- /dev/null +++ b/pkgs/applications/virtualization/virtualbox/hardened.patch @@ -0,0 +1,26 @@ +diff --git a/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp b/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp +index c39d2f7..f6a4031 100644 +--- a/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp ++++ b/src/VBox/HostDrivers/Support/SUPR3HardenedVerify.cpp +@@ -1415,7 +1415,7 @@ static int supR3HardenedVerifyFsObject(PCSUPR3HARDENEDFSOBJSTATE pFsObjState, bo + NOREF(fRelaxed); + #else + NOREF(fRelaxed); +- bool fBad = true; ++ bool fBad = !(fDir && pFsObjState->Stat.st_mode & S_ISVTX && !suplibHardenedStrCmp(pszPath, "/nix/store")); + #endif + if (fBad) + return supR3HardenedSetError3(VERR_SUPLIB_WRITE_NON_SYS_GROUP, pErrInfo, +diff --git a/src/VBox/Main/src-server/MachineImpl.cpp b/src/VBox/Main/src-server/MachineImpl.cpp +index 95dc9a7..39170bc 100644 +--- a/src/VBox/Main/src-server/MachineImpl.cpp ++++ b/src/VBox/Main/src-server/MachineImpl.cpp +@@ -7326,7 +7326,7 @@ HRESULT Machine::i_launchVMProcess(IInternalSessionControl *aControl, + + /* get the path to the executable */ + char szPath[RTPATH_MAX]; +- RTPathAppPrivateArch(szPath, sizeof(szPath) - 1); ++ RTStrCopy(szPath, sizeof(szPath) - 1, "/var/setuid-wrappers"); + size_t cchBufLeft = strlen(szPath); + szPath[cchBufLeft++] = RTPATH_DELIMITER; + szPath[cchBufLeft] = 0; -- cgit 1.4.1