allow only certain users to mount media
How do I allow only certain users to mount removable media (cdrom, usb drive, etc.)? By default, using the gnome desktop (for instance), HAL & friends automatically mount a CDROM that's inserted. I need to be able to restrict that to a small list of users. I'm just looking how to do this on a single machine for now.
|
I think only users parts of the group "plugdev" can automount but haven't really checked as nobody comes on my box..
|
Quote:
(Furthermore, there is no plugdev group on this box) |
Quote:
And it works (tm) sorry dunno fedora core |
If you do a ls -l /bin/mount, you'll see that the "special" (s) flag is set, which means (in this case, I believe) that mount is automatically run a "root" when invoked by another application (or user) running in the appropriate group.
Now, I don't know what command will display the groups the "special" setting allows to use the mount command, but I suspect that udev is starting a script when the CD/DVD device signals that a new disk has been inserted. If that's the case, you need to see what group the udev process uses to run the script, and how the mount is handled. Alternatively, you could use the chmod command to reset the "run as root" permissions on the mount command to a be some "cdmounter" group, and then make the privileged few members of the group. But that might have some unexpected impact on system operation, so, if I were you, I'd try it first on a stand-alone system and see if it works the way you want. Or perhaps someone more knowledgeable than I could tell us how to see the details of the "special" setting, or suggest some "proven" approach. |
Usually udev will create the device as root and as a last rule (/etc/udev/rules/z99_hal.rules) will tell HAL to mount the device using /usr/bin/pmount
pmount allows plugdev group to mount removable devices into /media ls -la /usr/bin/plugdev Code:
root@debian# ls -la /usr/bin/pmount create group plugdev add your user to plugdev group change ownership of /bin/mount to -rwsr-xr-- 1 root plugdev Then nobody but group plugdev would be able to mount _anything_ But /bin/mount is a critical program. I can't think of any side effect but yes, a proven/clean method would be better. |
All times are GMT -5. The time now is 03:43 PM. |