0

I am trying to block access to other partitions with different file systems on the same physical hdd (layout: gpt) by preventing any partition mounting without requiring a password.

FSTAB takes care of using mount with password. If it is not in FSTAB, it will require a password.

For Nautilus and udisks I was trying udev setting ENV{UDISKS_ commands like such:

KERNEL=="sda10", ENV{UDISKS_PRESENTATION_NOPOLICY}="1", ENV{UDISKS_SYSTEM_INTERNAL}="1"

I have verified that the ENV are added by using

udevadm info --name="/dev/sda10" --query=all

But this does not seem to stop (non-gksudo) Nautilus or udisks from mounting the partition when clicked.

I would like it to prompt a password when it tries. As is specified here:

http://manpages.ubuntu.com/manpages/precise/man7/udisks.7.html

If set, this will override the usual bus type based detection of whether a device is considered "system internal". "0" means "removable" (i. e. eligible for automounting, and normal users can mount), any other value means "system internal" (i. e. no automounting, and only administrators can mount).

Thanks in advance.

P.S. In contrast using this

KERNEL=="sda10", ENV{UDISKS_PRESENTATION_HIDE}="1"

does stop Nautilus from presenting the partition in the devices section. All though hiding probably does not stop udisks from mounting it anyway (have not tried that).

0

I think this should be possible with PolicyKit/polkit rules, rather than editing the udev rules directly.

By default on 12.04, mounting is allowed by default.

user@precise:~$ pkaction --verbose --action-id org.freedesktop.udisks.filesystem-mount
org.freedesktop.udisks.filesystem-mount:
  description:       Mount a device
  message:           Authentication is required to mount the device
  vendor:            The udisks Project
  vendor_url:        http://udisks.freedesktop.org/
  icon:              drive-removable-media
  implicit any:      no
  implicit inactive: no
  implicit active:   yes

It should be possible to create a local rule which overrides this (see man pklocalauthority), and requires authentication to perform this action. Create a file named, eg /etc/polkit-1/localauthority.conf.d/50-disable-automount.pkla containing:

[Disable automount]
Identity=unix-user:*
Action=org.freedesktop.udisks.filesystem-mount
ResultAny=auth_admin
ResultInactive=auth_admin
ResultActive=auth_admin

You might need to investigate some further details (eg, there are more specific actions like org.freedesktop.udisks.filesystem-mount-system-internal which presumably applies only to your local hard disks rather than USB sticks, and you can choose either auth_admin or auth_admin_keep depending on whether you want a recently entered password to be sufficient).

I'm not completely certain of some of the semantics of policykit, and documentation seems to be a bit sparse, so you might need to play a bit, but I think this is the Right way to do it. See here for the default policykit permissions for actions in Ubuntu.

  • I have looked at the Policy Kit defaults using your URL, and they seem to be ok. I do not wish to block portable drives, just the internal drives. Also used pkaction to see the local values. I have to verify if Policy Kit is active? Thanks for sending me in the direction of Policy Kit though. – Arvo Feb 10 '14 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.