VirtualBox GUI will not start for non-root user

astrogeek · 11-30-2008, 08:13 PM

I am completely new to VirtualBox and have built VirtualBox 2.0.6 from a SlackBuild script on a clean Slackware 12.1 install. I built and installed acpica, dev86, virtualbox-ose (with addons ISO) and virtualbox-kernel.

No compile errors.

I created the vboxusers group and added my user to it and logged out/in - group shows in output of groups command.

I made rc.vboxdrv and rc.vboxnet executable and started them both.

When I attemtpt to start the GUI as normal user with /usr/bin/VirtualBox3 I get:

Callee RC: NS_ERROR_FACTORY_NOT_REGISTERED

And it fails to run.

If I do the same as root user it starts OK.

I have re-re-read the VB documentation and Slackbuild notes but feel I must be missing something simple - path or permission maybe?

Any VirtualBox gurus with the quick answer?

Thanks in advance.

quiss42 · 12-01-2008, 01:35 AM

Try deleting /tmp/.vbox-*.

Quakeboy02 · 12-01-2008, 01:41 AM

Check the permissions of /dev/vboxdrv. Chances are that it's root/root. A suggested way is to have the group id be vboxusers, and add vboxusers to the group list of anyone you want to give access to VirtualBox.

Added:

Sorry, it's late.

I see that you've added vboxusers, but did you set the group id for /dev/vboxdrv to that?

astrogeek · 12-01-2008, 01:46 AM

The startup error message...

Callee RC:
NS_ERROR_FACTORY_NOT_REGISTERED (0x80040154)

...did not return any significant info on google, and I initially dismissed the error that appeared in the startup terminal window as a side-effect of the the other...

Wrong owner (0) of '/tmp/.vbox-slacker-ipc'.

...mostly because...

ls -al /tmp

...did not show any such file or directory, and ...and all other permissions including /drv/vboxdrv appeared to be correct according to the docs.

But it was operator error I suppose because after coming back to it after a break I found...

drwx------ 2 root root 4096 2008-11-30 17:26 /tmp/.vbox-slacker-ipc/

I simply removed this as root (OK according to TFM), then tried again - all works!

So, for others having trouble starting VirtualBox 2.0.6 - look for...

/tmp/.vbox-<username>-ipc/ owned by root - delete it and try again!

[EDIT]Thanks Quiss42 - we must have been typing at the same time! As I posted here, that was the problem![/EDIT]

cowyn · 12-01-2008, 08:53 AM

So, you enabled hardening by default.
But the SlackBuild of vbox-ose from SBo should have set suid.
try: chmod 4511 <path-to-`VirtualBox'-in-vbox-lib-dir>

astrogeek · 12-01-2008, 01:40 PM

Quote:

Originally Posted by Cherife

So, you enabled hardening by default.
But the SlackBuild of vbox-ose from SBo should have set suid.
try: chmod 4511 <path-to-`VirtualBox'-in-vbox-lib-dir>

Yes I enabled hardening by default. As I said, I am completely new to VirtualBox and it is my understanding that hardening basically means that access permissions to the vboxdrv is restricted - seemed like a good idea to me. It looks to me like the SBo script only passes the --enable-hardening parameter to the VirtualBox configure script but does not make any changes of it's own, unless the udev rules do it... is that correct?

I have not found any explanation of why my 'executable' is VirtualBox3 instead of VirtualBox - is that related to hardening also? Oh well, I am learning...

In any event - I am happily virtualizing now!

Thanks!

ppr:kut · 12-02-2008, 03:39 AM

Quote:

Yes I enabled hardening by default. As I said, I am completely new to VirtualBox and it is my understanding that hardening basically means that access permissions to the vboxdrv is restricted - seemed like a good idea to me. It looks to me like the SBo script only passes the --enable-hardening parameter to the VirtualBox configure script but does not make any changes of it's own, unless the udev rules do it... is that correct?

Hardening means that access to VirtualBox, in all ways, is restricted to users of the vboxusers group. Not only the kernel module, but also all (frontend) apps. Therefore the script does not only pass "--enable-hardening" to configure, but also forces the use of the vboxusers group and installs the affected binaries suid root (affected apps check for UID 0 on startup). With hardening disabled but vboxusers enabled, binaries are not installed suid root and can be run by any user in the vboxusers group.

Honestly, although I understand the vboxusers-configuration (and think it's a good idea), I still don't get what the benefit in security should be by forcing the VirtualBox binaries to run as root. But upstream requested it as default, so....

Quote:

I have not found any explanation of why my 'executable' is VirtualBox3 instead of VirtualBox - is that related to hardening also? Oh well, I am learning...

It's called "VirtualBox3" because it's using the Qt3 GUI. If you have enabled the Qt4 GUI as well/instead you'll have a "VirtualBox" binary (which is the upstream default by now). Qt3 GUI is the default in the SlackBuild for two reasons. First, Slackware 12.1 does not ship Qt4, so users would need to install it as well to run the GUI. Not necessary if the user doesn't want to and an alternative is available. Second, as the Qt4 GUI was presented as default with VirtualBox 2.0.0 is was way more unstable than the Qt3 GUI, so there wasn't much sense in setting it as default. However, in the meantime both GUIs are equally stable and one should preferably use the Qt4 GUI by now as the Qt3 one might be removed from upstream anytime.

Hope this clears things up a bit

astrogeek · 12-02-2008, 12:59 PM

Quote:

Originally Posted by ppr:kut

Hope this clears things up a bit

Thanks ppr:kut - that is the only direct explanation of those items that I have found anywhere! I appreciate you taking the time to write it for me!

jsmith6 · 12-03-2008, 03:57 PM

Hi ppr:kut!

I am trying to compile VirtualBox with your SlackBuild using this syntax:

Code:

HARDENING=no VBOXUSERS=yes ./virtualbox-ose.SlackBuild

But I still can't run it as a normal user, nor I can cd /usr/lib/virtualbox. The root suid is there, and the "world" flags don't allow read or execute.

For now, I just hacked it off with:

Code:

chmod -s /usr/lib/virtualbox/
chmod -s /usr/lib/virtualbox/* -R
chmod 755 /usr/lib/virtualbox
chmod 755 /usr/lib/virtualbox/* -R

but I would like to know how I can build this package the right way.

ppr:kut · 12-03-2008, 04:10 PM

Actually you don't need to explicitly define VBOXUSERS, as it's set to "yes" by default.

Quote:

But I still can't run it as a normal user, nor I can cd /usr/lib/virtualbox. The root suid is there, and the "world" flags don't allow read or execute.

That doesn't make sense, as the relevant code in the script is *only* executed when hardening is enabled. I suspect the generated package being right as you want, but maybe something on install is not working as expected. Anyway, it's rather late here, I'll have a look at it tomorrow.

jsmith6 · 12-03-2008, 05:35 PM

Let me add one more thing.

When I try to run a VM that I previously created with Vbox 1.6.x I get this message:

Quote:

VirtualBox kernel driver is not accessible, permission problem. If you have built VirtualBox yourself, make sure that you do not have the vboxdrv kernel module from a different build or installation loaded. Also, make sure the vboxdrv udev rule gives you the permission you need to access the device..

VBox status code: -1909 (VERR_VM_DRIVER_NOT_ACCESSIBLE).

I think this appeared after I tried to change the permitions of /dev/vboxdrv but it keeps popping after re-installing and re-starting.

VBox runs fine as root.

I think hack didn't actually work :P

ppr:kut · 12-04-2008, 02:50 PM

Alright, after taking a closer look at the script again, and also on your two posts I think you missunderstood some things. I try to explain the options again in detail:

Code:

HARDENING=yes VBOXUSERS=yes

- UPSTREAM / SLACKBUILD DEFAULT
- binaries installed suid root: yes
- user must be part of group vboxusers: yes
- VirtualBox runnable for users not in vboxusers: no

Code:

HARDENING=no VBOXUSERS=yes

- binaries installed suid root: no
- user must be part of group vboxusers: yes
- VirtualBox runnable for users not in vboxusers: no

Code:

HARDENING=no VBOXUSERS=no

- binaries installed suid root: no
- user must be part of group vboxusers: no
- VirtualBox runnable for users not in vboxusers: yes

As you now probably know, you seem to have configured virtualbox in another way then what you expected it to be. Your errors are all caused by the fact, that your user is not part of the vboxusers group. As you told the script to use the vboxusers group by passing "VBOXUSERS=yes" to the script, that would be the expected behavior and there is nothing wrong.

jsmith6 · 12-05-2008, 07:56 AM

You are right! I compiled again with:

Code:

HARDENING=NO ./virtualbox-ose.SlackBuild
KERNEL=2.6.24.5-smp ./virtualbox-kernel.SlackBuild

And I can run it as a normal user but when I try to launch a VM I get this error:

Code:

VirtualBox kernel driver is not accessible, permission problem. If you have built VirtualBox yourself, make sure that you do not have the vboxdrv kernel module from a different build or installation loaded. Also, make sure the vboxdrv udev rule gives you the permission you need to access the device..
VBox status code: -1909 (VERR_VM_DRIVER_NOT_ACCESSIBLE).

Result Code: 
NS_ERROR_FAILURE (0x80004005)
Component: 
Console
Interface: 
IConsole {e3c6d4a1-a935-47ca-b16d-f9e9c496e53e}

Here is a screenshot of it.

I do not get this message as root, and I can boot my VMs just fine as root. I am sure I executed /etc/rc.d/rc.vboxdrv and rc.vboxnet.

Is it an issue of permitions on /dev/vboxdrv? Here is my permitions:

Code:

crw-rw---- 1 root vboxusers 10, 60 2008-12-04 15:54 /dev/vboxdrv

ppr:kut · 12-05-2008, 08:04 AM

you are in vboxusers group?

jsmith6 · 12-05-2008, 08:53 AM

Quote:

Originally Posted by ppr:kut

you are in vboxusers group?

Yes, I added myself with vigr:

Code:

vboxusers:x:215:jsmith

Edit: I just re-compiled with

Code:

HARDENING=no VBOXUSERS=no ./virtualbox-ose.SlackBuild

but I still get the same error.