diff --git a/lib/licenses.nix b/lib/licenses.nix index 79124855f7f..1ec0e5149c9 100644 --- a/lib/licenses.nix +++ b/lib/licenses.nix @@ -613,6 +613,12 @@ lib.mapAttrs (n: v: v // { shortName = n; }) rec { fullName = "Vim License"; }; + virtualbox-puel = { + fullName = "Oracle VM VirtualBox Extension Pack Personal Use and Evaluation License (PUEL)"; + url = "https://www.virtualbox.org/wiki/VirtualBox_PUEL"; + free = false; + }; + vsl10 = spdx { spdxId = "VSL-1.0"; fullName = "Vovida Software License v1.0"; diff --git a/nixos/modules/virtualisation/virtualbox-host.nix b/nixos/modules/virtualisation/virtualbox-host.nix index b69860a199a..60779579402 100644 --- a/nixos/modules/virtualisation/virtualbox-host.nix +++ b/nixos/modules/virtualisation/virtualbox-host.nix @@ -6,7 +6,8 @@ let cfg = config.virtualisation.virtualbox.host; virtualbox = cfg.package.override { - inherit (cfg) enableExtensionPack enableHardening headless; + inherit (cfg) enableHardening headless; + extensionPack = if cfg.enableExtensionPack then pkgs.virtualboxExtpack else null; }; kernelModules = config.boot.kernelPackages.virtualbox.override { @@ -28,6 +29,17 @@ in ''; }; + enableExtensionPack = mkEnableOption "VirtualBox extension pack" // { + description = '' + Whether to install the Oracle Extension Pack for VirtualBox. + + + You must set nixpkgs.config.allowUnfree = true in + order to use this. This requires you accept the VirtualBox PUEL. + + ''; + }; + package = mkOption { type = types.package; default = pkgs.virtualbox; @@ -45,8 +57,6 @@ in ''; }; - enableExtensionPack = mkEnableOption "VirtualBox extension pack"; - enableHardening = mkOption { type = types.bool; default = true; diff --git a/nixos/tests/virtualbox.nix b/nixos/tests/virtualbox.nix index 008dab8459c..4207112cf16 100644 --- a/nixos/tests/virtualbox.nix +++ b/nixos/tests/virtualbox.nix @@ -293,6 +293,11 @@ let "--hostonlyadapter2 vboxnet0" ]; + # The VirtualBox Oracle Extension Pack lets you use USB 3.0 (xHCI). + enableExtensionPackVMFlags = [ + "--usbxhci on" + ]; + dhcpScript = pkgs: '' ${pkgs.dhcp}/bin/dhclient \ -lf /run/dhcp.leases \ @@ -323,13 +328,17 @@ let headless.services.xserver.enable = false; }; - mkVBoxTest = name: testScript: makeTest { + vboxVMsWithExtpack = mapAttrs createVM { + testExtensionPack.vmFlags = enableExtensionPackVMFlags; + }; + + mkVBoxTest = useExtensionPack: vms: name: testScript: makeTest { name = "virtualbox-${name}"; machine = { lib, config, ... }: { imports = let mkVMConf = name: val: val.machine // { key = "${name}-config"; }; - vmConfigs = mapAttrsToList mkVMConf vboxVMs; + vmConfigs = mapAttrsToList mkVMConf vms; in [ ./common/user-account.nix ./common/x11.nix ] ++ vmConfigs; virtualisation.memorySize = 2048; virtualisation.virtualbox.host.enable = true; @@ -337,6 +346,8 @@ let users.users.alice.extraGroups = let inherit (config.virtualisation.virtualbox.host) enableHardening; in lib.mkIf enableHardening (lib.singleton "vboxusers"); + virtualisation.virtualbox.host.enableExtensionPack = useExtensionPack; + nixpkgs.config.allowUnfree = useExtensionPack; }; testScript = '' @@ -353,7 +364,7 @@ let return join("\n", grep { $_ !~ /^UUID:/ } split(/\n/, $_[0]))."\n"; } - ${concatStrings (mapAttrsToList (_: getAttr "testSubs") vboxVMs)} + ${concatStrings (mapAttrsToList (_: getAttr "testSubs") vms)} $machine->waitForX; @@ -363,11 +374,11 @@ let ''; meta = with pkgs.stdenv.lib.maintainers; { - maintainers = [ aszlig wkennington ]; + maintainers = [ aszlig wkennington cdepillabout ]; }; }; -in mapAttrs mkVBoxTest { +in mapAttrs (mkVBoxTest false vboxVMs) { simple-gui = '' createVM_simple; $machine->succeed(ru "VirtualBox &"); @@ -473,4 +484,22 @@ in mapAttrs mkVBoxTest { destroyVM_test1; destroyVM_test2; ''; +} // mapAttrs (mkVBoxTest true vboxVMsWithExtpack) { + enable-extension-pack = '' + createVM_testExtensionPack; + vbm("startvm testExtensionPack"); + waitForStartup_testExtensionPack; + $machine->screenshot("cli_started"); + waitForVMBoot_testExtensionPack; + $machine->screenshot("cli_booted"); + + $machine->nest("Checking for privilege escalation", sub { + $machine->fail("test -e '/root/VirtualBox VMs'"); + $machine->fail("test -e '/root/.config/VirtualBox'"); + $machine->succeed("test -e '/home/alice/VirtualBox VMs'"); + }); + + shutdownVM_testExtensionPack; + destroyVM_testExtensionPack; + ''; } diff --git a/pkgs/applications/virtualization/virtualbox/default.nix b/pkgs/applications/virtualization/virtualbox/default.nix index f9770435aaf..94fc9697e54 100644 --- a/pkgs/applications/virtualization/virtualbox/default.nix +++ b/pkgs/applications/virtualization/virtualbox/default.nix @@ -6,7 +6,7 @@ , xorriso, makeself, perl , javaBindings ? false, jdk ? null , pythonBindings ? false, python2 ? null -, enableExtensionPack ? false, requireFile ? null, fakeroot ? null +, extensionPack ? null, fakeroot ? null , pulseSupport ? false, libpulseaudio ? null , enableHardening ? false , headless ? false @@ -19,30 +19,9 @@ with stdenv.lib; let python = python2; buildType = "release"; - # Manually sha256sum the extensionPack file, must be hex! - # Do not forget to update the hash in ./guest-additions/default.nix! - extpack = "d90c1b0c89de19010f7c7fe7a675ac744067baf29a9966b034e97b5b2053b37e"; - extpackRev = "123301"; + # Remember to change the extpackRev and version in extpack.nix as well. main = "ee3af129a581ec4c1a3e777e98247f8943e976ce6edd24962bcaa5c53ed1f644"; version = "5.2.14"; - - # See https://github.com/NixOS/nixpkgs/issues/672 for details - extensionPack = requireFile rec { - name = "Oracle_VM_VirtualBox_Extension_Pack-${version}-${toString extpackRev}.vbox-extpack"; - sha256 = extpack; - message = '' - In order to use the extension pack, you need to comply with the VirtualBox Personal Use - and Evaluation License (PUEL) available at: - - https://www.virtualbox.org/wiki/VirtualBox_PUEL - - Once you have read and if you agree with the license, please use the - following command and re-run the installation: - - nix-prefetch-url http://download.virtualbox.org/virtualbox/${version}/${name} - ''; - }; - in stdenv.mkDerivation { name = "virtualbox-${version}"; @@ -174,7 +153,7 @@ in stdenv.mkDerivation { ln -s "$libexec/$file" $out/bin/$file done - ${optionalString enableExtensionPack '' + ${optionalString (extensionPack != null) '' mkdir -p "$share" "${fakeroot}/bin/fakeroot" "${stdenv.shell}" <