virtualbox.org

I was just installing Extension Pack for the first time on my MacOS BigSur 11.6 machine.

After I agreed to the terms, a window pops up: "VirtualBox needs further rights to make changes to your installation. Enter your password to allow this."

It looks to me like this is not MacOS asking this or else it would have offered to let me use my fingerprint rather than my password.

I've Googled for this text on the internet and not found a match in any discussion forums. I did find a match in the VBox source code. (The file name is VBoxExtPackHelperApp.cpp)

I've be happy to offer my password to MacOS and then grant selected permissions to VirtualBox, but giving my password directly to VB seems ominous.

Is this expected/vetted/code-reviewed behavior?

It's normal behaviour. MacOS effectively requires "sudo" access to make this change, i.e. adding a new package in an app executable folder. IIRC (I'm not a Mac user) it only happens the first time, i.e. creation.

And btw, it's not VirtualBox that wants your password, it's MacOS. While that specific caption is supplied by VirtualBox, I'm sure you'll find that the dialog itself is displayed and managed by a MacOS API called by VirtualBox (see the <Security/Authorization.h> header includes at the top of that source file).