Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

In Ubuntu 11.04 I could mount a file system in /media/foo and run chown guest:guest /media/foo/bar -R and have full access in the guest account. After the upgrade to 12.04 I changed my routine to reflect the new guest usernames (chown guest[id]:guest[id] /media/foo/bar -R) but I still can't access it as a guest user, as I don't have access privileges to /media as guest:

ls: cannot open directory /media: Permission denied

(Very interestingly this does work if I su into the guest account as root). I understand this is meant as a security measure but I don't see how it is done. ls -l / reports

drwxr-xr-x  11 root root  4096 Sep  9 22:28 media

Thus my two questions: How does this restriction work and how can I access a mounted file system as a guest user, ideally without allowing access to all of the other mounted file systems?

share|improve this question
1  
I just found out this has something to do with an AppArmor profile constricting lightdm-guest-session-wrapper: bugs.launchpad.net/ubuntu/+source/lightdm/+bug/849027 –  Perseids Sep 18 '12 at 17:52

1 Answer 1

up vote 3 down vote accepted

Access to /media is restricted by the AppArmor profile /etc/apparmor.d/lightdm-guest-session. There are two exceptions (lines 31 and 32):

 owner /media/ r,
 owner /media/** rmwlixk,  # we want access to USB sticks and the like

That allows access if /media/foo is owned by guest[id], which is the first alternative to solve my problem. The downside is that the guest account can create arbitrary directories and files in the root of /media/foo. I decided to explicitly poke a hole for /media/foo/bar and added the lines:

 owner /media/foo/bar rw,

A description of the syntax can be found here: http://doc.opensuse.org/documentation/html/openSUSE/opensuse-security/cha.apparmor.profiles.html

To the best of my knowledge this only allows the guest session to access /media/foo/bar and only if guest[id] is the owner of bar. Note that guest[id] still cannot access /media/foo itself. Thus ls /media/foo will fail, but ls /media/foo/bar works.

Lastly reload the profile for the changes to take effect:

 sudo apparmor_parser -r /etc/apparmor.d/lightdm-guest-session
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.