add warning about vbox permission