1

I've just made a new user account for a friend of mine. But I don't want him to have access to my data drive ( it's not the drive where ubuntu is installed on but just a data drive ).

How can I disable that drive for him?

I'm using ubuntu 14.04.

EDIT:

blkid:

/dev/sda1: UUID="eee523f2-0eb4-4ee8-b758-f8ea89273233" TYPE="ext4" 
/dev/sda5: UUID="69b06774-64ed-4c11-b157-5a794c20c98c" TYPE="swap" 
/dev/sdb2: UUID="5E521E0E521DEC11" TYPE="ntfs" 

lsblk:

enter image description here

EDIT:

basement21@basement21:~$ groups basement21
basement21 : basement21 adm cdrom sudo dip plugdev lpadmin sambashare secretdrive
basement21@basement21:~$ groups planner
planner : planner
basement21@basement21:~$ 
6
  • what type is it? (ntfs/ext4) Mar 21, 2015 at 13:02
  • How can I check this? Mar 21, 2015 at 13:04
  • if you run sudo blkid you can find out. Mar 21, 2015 at 13:06
  • also, what is its mountpoint? (run lsblk) Mar 21, 2015 at 13:06
  • I've edited my post with the output of these commands. It my /mnt/data I want to disable for that user. Mar 21, 2015 at 13:10

4 Answers 4

2

Change /mnt/data owner and group to yourself like this:

sudo chown basement21.basement21 /mnt/data

And allow only you to read and write, and your personal group to only read:

sudo chmod 750 /mnt/data
1

To achieve the desire result as you indicated:

Call your system to recognize /dev/sdb to belong to you:

sudo adduser secretdrive
sudo chown secretdrive:secretdrive /dev/sdb
sudo adduser [your-username] secretdrive
sudo chmod 770 /dev/sdb

Explanation:

  1. assign a new system name to your drive: /dev/sdb
  2. chown-ize your drive to the system username of secretdrive (or whichever name you want)
  3. add your username to the group belonging to secretdrive so that way system will grant you the access to the drive
  4. finally, you chmod-ize your drive to 770 (read/write by owner | read/write by group | no-read/no-write to rest of everybody else)
1
  • sorry for the late response. It doesn't work. I did everything you said but when I add another user for my friend and I login on his account he still sees my secretdrive. Do I need to change something? I set my drive to automatically mount is that a problem? Please check my edit. Planner is the account for my friend. Thanks for all your effort btw Mar 25, 2015 at 17:48
1

The solution below assumes your friend is not an expert, trying to hack your computer to find a way to look into your data. It is however a reasonable threshold, to prevent unintended access (mounting) to a specific partition or drive.


An option, that also can be used as a more temporary solution on any user account is the following:

  1. Add the following to the sudoers file (/etc/sudoers, running sudo visudo):

    <your_friends_username> ALL = NOPASSWD: /bin/umount
    

    This will enable him to unmount a drive without sudo password

  2. In your friends' account, copy the script below into an empty file and save it somewhere as nomount.py (or better, a less revealing name :) )
  3. Test-run (still in your friends' account) the script by the command:

    python3 /path/to/nomount.py /mnt/data
    

    and try to mount the drive. It should fail.

  4. If it works as expected, add it to your friends' account Startup Applications: Dash > Startup Applications > Add the command:

    ppython3 /path/to/nomount.py /mnt/data
    

The script

#!/usr/bin/env python3
import subprocess
import time
import sys
drive = sys.argv[1]
while True:
    check = subprocess.check_output("lsblk").decode("utf-8")
    if drive in check:
        subprocess.Popen(["sudo", "umount", "-l", drive])
    time.sleep(1)

What the script does

In a loop (once per second), the script checks if the "forbidden" drive is mounted. If so, it will immediately (forcefully) unmount the drive, with the command umount -f <drivename>.

Edit

A bash version of the script:

#!/bin/bash
drive="$1"
while true
do
    if [ -n "$(lsblk | grep $drive)" ]; then
        sudo umount -l $drive
    fi
    sleep 1
done

Set up and use it similarly to the python script, only:

  • save it as nomount.sh
  • run it by the command:

    sh /path/to/nomount.sh /mnt/data
    

    (like the python version; use the drive to make unavailable as an argument)

Edit 2

About security:

With the right skills and information, practically all solutions can be surpassed. A simple example: with enough time, all solutions would break by simply starting up from a startup usb, unless you encrypted the drive.

In the solution above, the most obvious way would be to open a terminal window, run ps -u <username>, look for the process to kill (the script), and kill it. Your friend would however need to have the skills to do that, the intention to do that and the knowledge to suspect that it is done this way.

You can make the process less likely to be recognized, by a few simple additions to the setup:

  1. Give the script a disguising name like unity-desk (I checked if the name didn't clash with an existing command) without extension*
  2. Make it executable, to be able to run it without the preceding sh or python3.

This way, you can run the script with the command:

unity-desk /mnt/data

In both ps -u <username> and ps -e the process would be mentioned as unity-desk. Not really a process (-name) you'd likie to kill on first sight.
The command to reveal the fact that it is a script would be to run ps -ef which would show the path and the language. However, that would however again be a step further.

5
  • He just doesn't want his wife to have access to his pr0n drive... ;-) I would have said to convert the NTFS drive to EXT4, don't make his wife an admin and set security on the directory so that it can only be mounted by one user (and root). Your solution does not require any conversion so is more elegant so upvoted! ;-)
    – Fabby
    Mar 24, 2015 at 22:30
  • @user1007522: Don't thank Jacob! ;-) If you like his answer, just click the little grey under the "0" now turning it into beautiful green. If you do not like his answer, click on the little grey down-arrow below the 0, and if you really like my answer, click on the little grey checkmark and the little up-arrow... ;-)
    – Fabby
    Mar 24, 2015 at 22:31
  • lol :-) it's not for my prOn. It bothers me that you say this is not very safe.. Mar 25, 2015 at 17:42
  • I did not upvote or downvoted anything :s. Mar 26, 2015 at 8:30
  • I'm going to try your solution because the other one with the groups and stuff don't work. I hope I have some time this evening. No problem you don't need to apologize :-) Mar 26, 2015 at 8:55
0

After a long search I've found what the problem was. When I installed my system I added this line in my fstab:

/dev/disk/by-uuid/5E521E0E521DEC11 /mnt/data auto nosuid,nodev,nofail,x-gvfs-show 0 0

I changed it to:

/dev/disk/by-uuid/5E521E0E521DEC11 /mnt/data auto nosuid,nodev,gid=1000,umask=007,nofail,x-gvfs-show 0 0

My groupid is 1000 and the umask defines I've got the reading/write permission and everyone in my group too. The rest has no permission.

3
  • "After a long search I've found what the problem was". I am not sure I understand: which problem?. You must be referring to one of the other answers? Mar 29, 2015 at 14:00
  • Yes, because of that line it was ALWAYS mounted even when I created a separate account for the drive and add a group to it. So thats why you must add gid and umask. If you don't the fstab overwrites the group thing that Faron and Madneon gave as solution. Mar 30, 2015 at 12:00
  • Not my case, but what you actually say is that either one of their solution works. IMO would be nicer to give (either one) the credits and add your comment why it didn't work at first. Mar 30, 2015 at 12:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .