until I figure that one out

The effect of the static_node option is that the rule is also applied to the static node created via the modules.devname mechanism. Without this option, the rule is only applied once the kernel module has been loaded. Thus, without the node the permissions of will look like this:

crw------- 1 root root 10, 170 25. Feb 18:36 /dev/vhba_ctl

In result, a normal user won't be able to use cdemu, as the cdemu daemon runs in the users session and they are unable to access the device file, thus unable to trigger loading of the kernel module.

If the static_node option is used, udev will also apply the rule to the node created via modules.devname. Thus, the acl will be set such that a regular user can access the file and trigger the dynamic loading of the kernel module.

# file: dev/vhba_ctl
# owner: root
# group: root
user::rw-
user:<desktop-user>:rw-
group::---
mask::rw-
other::---