How can I prevent a standard account to mount a specific partition?

Question

I have a root account from which I do all of my tasks. I set up my partitions to mount at startup. I have also created an account for my younger brother. I do not want him to access specific partitions, while still having access to others.

I have:

• sda5
• sda6
• sda7

I want to block access to sda5 but want to give him permission to access the other sda partitions. How can I do that?

Answer 1

Thanks for the help guys. Both the answers helped me find out what I need to do. Here's what I have done.

My other sda are ntfs file system so I cannot directly change permission. So I have to mount it in a folder to which only I have access.

I make a folder in /media named secret with terminal

cd /media
sudo mkdir -p secret

Then I change ownership of this folder with chown command.

sudo chown XXXX:XXXX /media/secret

Where XXXX in my user name. Then I changed permission to that folder so that only I can access.

sudo chmod 700 /media/secret

Then I had to edit /etc/fstab for appropriate mounting point of sda5.

gksudo gedit /etc/fstab

Then add

/dev/sda5        /media/secret  ntfs defaults           0  0

at the end and saved it. Then reboot.

Viola! It worked.

Answer 2

Assuming your friend's name is Alice and she already has an account on your system, you can set up your drives such that they are automatically mounted with your ideal configuration. This is done by editing /etc/fstab.

non-ext4

The permissions for the drive may be determined completely within /etc/fstab for most filesystems.

Add the following to your /etc/fstab

/dev/sda5 /mnt/Secret ext3 defaults 0 0
/dev/sda6 /mnt/Shared ext3 defaults,uid=1000,gid=1000 0 0

You can determine a user or group's ID by looking at /etc/passwd or /etc/group.

ext4

ext4 does not allow uid/gid options. You will set the permission by changing the mount directories' rights.

Add the following to your /etc/fstab

/dev/sda5 /mnt/Secret ext4 defaults 0 0
/dev/sda6 /mnt/Shared ext4 defaults 0 0

Assign the permissions

chown root:root /mnt/Secret
chmod 770 /mnt/Secret
chown alice:alice /mnt/Shared
chmod 777 /mnt/Shared

You could also create a group of users, such as shared, and only give that group permissions for the drive.

Answer 3

If it has the right filesystem, you can change the permissions of the folder where it is mounted. For example, if it is mounted as /media/sda5, you need to type the following at the terminal (Ctrl+T).

sudo chown your_username:your_username /media/sda5
sudo chmod 700 /media/sda5

This will allow only the user specified by your_username, as well as the root user, to access the files. This will not work for some filesystems, such as NTFS. In that case, you will need to change the permissions of the parent directory. For example, if you have mounted it as /media/private/sda5, you will need to apply the operations to the /media/private directory. This will restrict access.

Answer 4

My solution will be simple.

• Open the /etc/fstab file with root permission.

• Add this line and save and close the file.

  /dev/sda5 /media/secret ntfs defaults 0 0
  

• Then anytime he wants to mount it, it will ask for password, which only you know. So, safe and easy. You can mount it easily with terminal

  sudo mount /dev/sda5
  

For the other partitions, both user can mount them via nautilus easily. or as you said, You have a setting to mount them automatically. That's it. Only the setting for /dev/sda5 need to be changed.

It's easy, isn't it?

---

As a comment from Eliah Kagan suggests that, the non-root users can still mount it. IMHO it is actually no. Even admin users can't mount the partitions without giving explicitly their password in terminal.

I tested this:

I have an ntfs partition which is /dev/sda3. I created an entry in /etc/fstab like this one:

 /dev/sda3   /media/works  ntfs   defaults  0   0

The result is, when I tried to execute it via nautilus, this error message is displayed.

When I tried to mount it via terminal with udisks --mount /dev/sda3 , this error message is displayed

Mount failed: Error mounting: mount exited with exit code 1: helper failed with:
mount: only root can mount /dev/sda3 on /media/works

So, It actually prevents non-root users, even the root users. They can only mount it via mount command and giving the password as below:

 sudo mount /dev/sda3