The solution below assumes your friend is not an expert, trying to hack your computer to find a way to look into your data. It is however a reasonable threshold, to prevent unintended access (mounting) to a specific partition or drive.
An option, that also can be used as a more temporary solution on any user account is the following:
Add the following to the sudoers
file (/etc/sudoers
, running sudo visudo
):
<your_friends_username> ALL = NOPASSWD: /bin/umount
This will enable him to unmount a drive without sudo password
- In your friends' account, copy the script below into an empty file and save it somewhere as
nomount.py
(or better, a less revealing name :) )
Test-run (still in your friends' account) the script by the command:
python3 /path/to/nomount.py /mnt/data
and try to mount the drive. It should fail.
If it works as expected, add it to your friends' account Startup Applications: Dash > Startup Applications > Add the command:
ppython3 /path/to/nomount.py /mnt/data
The script
#!/usr/bin/env python3
import subprocess
import time
import sys
drive = sys.argv[1]
while True:
check = subprocess.check_output("lsblk").decode("utf-8")
if drive in check:
subprocess.Popen(["sudo", "umount", "-l", drive])
time.sleep(1)
What the script does
In a loop (once per second), the script checks if the "forbidden" drive is mounted. If so, it will immediately (forcefully) unmount the drive, with the command umount -f <drivename>
.
Edit
A bash version of the script:
#!/bin/bash
drive="$1"
while true
do
if [ -n "$(lsblk | grep $drive)" ]; then
sudo umount -l $drive
fi
sleep 1
done
Set up and use it similarly to the python
script, only:
Edit 2
About security:
With the right skills and information, practically all solutions can be surpassed. A simple example: with enough time, all solutions would break by simply starting up from a startup usb, unless you encrypted the drive.
In the solution above, the most obvious way would be to open a terminal window, run ps -u <username>
, look for the process to kill (the script), and kill it. Your friend would however need to have the skills to do that, the intention to do that and the knowledge to suspect that it is done this way.
You can make the process less likely to be recognized, by a few simple additions to the setup:
- Give the script a disguising name like
unity-desk
(I checked if the name didn't clash with an existing command) without extension*
- Make it executable, to be able to run it without the preceding
sh
or python3
.
This way, you can run the script with the command:
unity-desk /mnt/data
In both ps -u <username>
and ps -e
the process would be mentioned as unity-desk
. Not really a process (-name) you'd likie to kill on first sight.
The command to reveal the fact that it is a script would be to run ps -ef
which would show the path and the language. However, that would however again be a step further.
sudo blkid
you can find out.lsblk
)