anchor.diff:          group = "vboxusers";
           setuid = true;
         };
  -    in map mkVboxStub [
  +    in mkIf cfg.enableHardening (map mkVboxStub [
         "VBoxHeadless"
         "VBoxSDL"
         "VirtualBox"
  -    ];
  +    ]);
   
       users.extraGroups.vboxusers.gid = config.ids.gids.vboxusers;
   
  
positive.code: with lib;
  
  let
    virtualbox = config.boot.kernelPackages.virtualbox;
  in
  
  {
    options = {
      services.virtualboxHost.enable = mkEnableOption "VirtualBox Host support";
      services.virtualboxHost.addNetworkInterface = mkOption {
        type = types.bool;
        default = true;
        description = "Automatically set up a vboxnet0 host-only network interface.";
      };
    };
  
    config = mkIf config.services.virtualboxHost.enable (mkMerge [{
      boot.kernelModules = [ "vboxdrv" "vboxnetadp" "vboxnetflt" ];
      boot.extraModulePackages = [ virtualbox ];
      environment.systemPackages = [ virtualbox ];
  
negative.code:       '';
  
      # Since we lack the right setuid binaries, set up a host-only network by default.
    } (mkIf cfg.addNetworkInterface {
      systemd.services."vboxnet0" =
        { description = "VirtualBox vboxnet0 Interface";
          requires = [ "dev-vboxnetctl.device" ];
  