ntfs-3g as normal user without having access rights to volume

10110111 · 06-03-2009, 07:57 PM

I need to be able to mount NTFS volumes as normal user but without having to chmod/chown this volume for security reasons.
ntfs-3g FAQ says

Quote:

Unprivileged block device mounts work only if all the below requirements are met:

1. ntfs-3g is compiled with integrated FUSE support
2. the ntfs-3g binary is at least version 1.2506
3. the ntfs-3g binary is set to setuid-root
4. the user has access right to the volume
5. the user has access right to the mount point

and

Quote:

The 'mount' command doesn't invoke the ntfs-3g binary with the needed privilege after it has checked and approved the user is entitled to mount a given device on a specified mount point, hereby the user can't open the device he got the approval in /etc/fstab. This is a problem in the 'mount' utility.

So, as i see, neither ntfs-3g, nor util-linux projects are willing to make things work (souldn't this have already been reported to util-linux?). How could i then achieve my goal? How do you cope with such problems? No one of the distros i tried have any applied solutions for this.

Matir · 06-03-2009, 08:04 PM

I'm not sure what you want to do is secure. That aside, here's the problem:

If mount invokes ntfs-3g as root (which it doesn't for security reasons), then all the permissions on the NTFS volume will be granted to only the root user. If it's not root, it needs permissions to read the volume.

It's not that ntfs-3g and util-linux are unwilling to make things work, it's just that there's no secure way to do it.

Uncle_Theodore · 06-03-2009, 08:25 PM

In theory, you can set /bin/ntfs-3g to suid root (chmod +s /bin/ntfs-3g) and make sure your user has access to the proper device, like /dev/sda1 (usually, you just need to include your user into the appropriate group) and has the access to the mountpoint. Then, it will work.

John VV · 06-03-2009, 10:43 PM

why not just have is auto mount with a fstab entry to allow users to r/w

10110111 · 06-04-2009, 01:59 AM

Quote:

If mount invokes ntfs-3g as root (which it doesn't for security reasons), then all the permissions on the NTFS volume will be granted to only the root user. If it's not root, it needs permissions to read the volume.

Using sudo mount works without problems to access mounted volume by non-root users. But the only thing i need is to be able to mount NTFS volumes as any other volume like ext3, i.e. without having rw permissions for /dev/sd*, but having fstab entry.

Quote:

make sure your user has access to the proper device, like /dev/sda1 (usually, you just need to include your user into the appropriate group)

Yes, that's just what FAQ says. But if i add the user into "disk" group, the user will be able to r/w any disk in the system, be it mounted or not. If make user able to r/w only NTFS disks, that means that something should be seriously tweaked in the system, e.g. udev rules to change group of NTFS volumes to something specific like ntfsuser.
But changing volume permissions is what i want to avoid at all.

Matir · 06-04-2009, 08:00 PM

Most filesystem drivers (ext3, etc.) are implemented in the kernel. NTFS-3g uses FUSE, so the NTFS-3g process needs permissions to read the device containing the filesystem.

10110111 · 06-05-2009, 06:44 AM

Quote:

NTFS-3g process needs permissions to read the device containing the filesystem.

But it IS setuid. Why then it refuses to use these permissions given by setuid bit?

Code:

$ ls -l `which ntfs-3g`
-rwsr-xr-x 1 root root 89547 2009-06-04 12:37 /bin/ntfs-3g
$ mount /mnt/docs
Error opening '/dev/sda1': Permission denied
Failed to mount '/dev/sda1': Permission denied
Please check '/dev/sda1' and the ntfs-3g binary permissions,
and the mounting user ID. More explanation is provided at
http://ntfs-3g.org/support.html#unprivileged

Yiguro · 07-25-2010, 12:13 PM

To mount ntfs partition as user, I did the following (as stated in ntfs-3.org)

Code:

[root@fedora standard]# chown root $(which ntfs-3g)
[root@fedora standard]# chmod 4755 $(which ntfs-3g)

Then add the user to 'disk' group so that it can write to /dev/sda*

Code:

[root@fedora standard]# usermod -aG disk your_username

This works:

Code:

[standard@fedora ~]$ ntfs-3g /dev/sda1 /media/XP

Mounting through nautilus or using 'mount' command fails:

Code:

[standard@fedora ~]$ mount /dev/sda1 /media/XP
mount: only root can do that

10110111 · 08-12-2010, 05:56 AM

Quote:

Then add the user to 'disk' group so that it can write to /dev/sda*

As i have already written,

Quote:

Originally Posted by 10110111

if i add the user into "disk" group, the user will be able to r/w any disk in the system, be it mounted or not. If make user able to r/w only NTFS disks, that means that something should be seriously tweaked in the system, e.g. udev rules to change group of NTFS volumes to something specific like ntfsuser.
But changing volume permissions is what i want to avoid at all.