It is not a good solution, to alter .policy
files in /usr/share/polkit-1/actions
directory, as other answers suggest, since the files may be overwritten on software update. A permanent solution is to create a .pkla
file in a sub-directory of /etc/polkit-1/localauthority
directory, as man pklocalauthority
suggests. While .policy
files declare actions and default PolicyKit behavior for them, .pkla
files adjust that behavior.
Start editing a new .pkla
file:
sudo nano /etc/polkit-1/localauthority/50-local.d/50-easy-mount.pkla
If you only care for local sessions (using local monitor and keyboard), write this:
[Allow local mounting without password]
Identity=unix-group:sudo;unix-group:plugdev
Action=org.freedesktop.udisks2.filesystem-mount
ResultActive=yes
In Debian (and Ubuntu is Debian-based), members of plugdev
user group are allowed to mount removable devices and members of sudo
are allowed anything. So, you only allow password-less mounting to those who have the rights to mount anyway. (In Ubuntu 20.04 and probably in many other systems, you don't rather need to allow this, as it is already allowed in /usr/share/polkit-1/actions/org.freedesktop.UDisks2.policy
).
If you wish to also allow mounting in ssh sessions, write this:
[Allow mounting without password]
Identity=unix-group:sudo
Action=org.freedesktop.udisks2.filesystem-mount;org.freedesktop.udisks2.filesystem-mount-other-seat
ResultAny=yes
Here, password-less mounting is granted to admins only (sudo
user group), because org.freedesktop.udisks2.filesystem-mount-other-seat
action is triggered on mounting attempt by a user who is logged in via ssh and is not logged in locally at the same time. So, mounting with this action potentially allows access to a USB flash drive of another person who is working locally. Change the Identity
key to whatever suits your security considerations. For example, to grant password-less mounting to admins and users john
and mary
, you write:
Identity=unix-group:sudo;unix-user:john;unix-user:mary
Mount like this:
udisksctl mount --options noatime --block-device /dev/sdb1
Unmounting own mounts doesn't ask for password:
udisksctl unmount --block-device /dev/sdb1
See man pklocalauthority
, man polkit
and man udisksctl
for more details. Tested on Ubuntu 20.04.