ideally udev-acl should be used here, feel free to implement
maybe udev rules for guest should be split to different file, currently
it's in main VirtualBox package
# udev rules for VirtualBox
# udev rules for VirtualBox
KERNEL=="vboxdrv", GROUP="vbox", MODE="0660"
KERNEL=="vboxnetctl", GROUP="vbox", MODE="0660"
KERNEL=="vboxdrv", GROUP="vbox", MODE="0660"
KERNEL=="vboxnetctl", GROUP="vbox", MODE="0660"
SUBSYSTEM=="usb_device", ACTION=="remove", RUN+="VBoxCreateUSBNode.sh --remove $major $minor"
SUBSYSTEM=="usb", ACTION=="remove", ENV{DEVTYPE}=="usb_device", RUN+="VBoxCreateUSBNode.sh --remove $major $minor"
SUBSYSTEM=="usb_device", ACTION=="remove", RUN+="VBoxCreateUSBNode.sh --remove $major $minor"
SUBSYSTEM=="usb", ACTION=="remove", ENV{DEVTYPE}=="usb_device", RUN+="VBoxCreateUSBNode.sh --remove $major $minor"
+
+# Devices in Guest, should use acl really
+KERNEL=="vboxguest", GROUP="vbox", MODE="0600"
+KERNEL=="vboxuser", GROUP="vbox", MODE="0666"