4

I am working on converting an Ubuntu (14.04 LTS) installation into a kiosk-like system with disabled USB storage. However, this does not prevent a user from mounting an MTP device such as an android phone.

This problem is not the same as preventing auto-mounting of MTP devices, which has been solved in other questions on AskUbuntu.

  1. I want to permanently disallow MTP and other storage devices from being mounted by a particular user or group. (Maybe by disabling mtpfs/gvfs?)
  2. What some other means of connecting writeable storage devices that I should take care of (like UMTS)?

--

edit: I should add that I disabed USB storage by revoking access rights for the group in question by chown'ing /media to admin:myusbaccessgroup. Obviously, the users/groups I want to prevent from using the USB are not in myusbaccessgroup.

--

Update:

A bounty was put for this answer but no successful solution was found. Please see the answers before followed by the chat room discussion.

Giving up, I installed Ubuntu 12.04 instead, since it doesn't have support for MTP out of the box. However, PTP devices still get mounted.

  • I wanted to add a bounty too. I could not find a solution myself. I will give an additional bounty, if we get an answer. – Pilot6 Sep 14 '15 at 15:38
  • Have you tried changing ownership of the device (like /dev/mtp1 or whatever) to root:root? – Daniel Sep 14 '15 at 15:47
  • Then they would need sudo access, and you can disable sudo access for that user/group – Daniel Sep 14 '15 at 15:48
  • @Daniel, root:rooting /dev/ but to no avail. The users/groups I need to disable this for are not in the sudo group. – Akshay Rao Sep 14 '15 at 16:03
  • @Pilot6, hope this works out! – Akshay Rao Sep 14 '15 at 16:03
3
+25

I couldn't get it to work using user/group permissions neither I know how libmtp mount phones volumes.

This is a solution to check the user group from udev side.

  1. Switch to root

    sudo -i
    
  2. Create a generic script to check GUI user and if it's in specified group

    nano /lib/udev/check_gui_user_group.sh
    

    Add these line to it:

    #!/bin/bash
    
    export GUI_$(grep -z USER /proc/$(pgrep -nx $1)/environ)
    groups $GUI_USER | grep -qFw "$2"
    

    Add executing permission

    chmod +x /lib/udev/check_gui_user_group.sh
    
  3. MTP devices: Let override libmtp rules in /lib/udev/rules.d/ .

    cp /lib/udev/rules.d/69-libmtp.rules /etc/udev/rules.d/69-libmtp.rules
    

    Then open it for editing:

    nano /etc/udev/rules.d/69-libmtp.rules
    

    Add this line just after LABEL="libmtp_usb_rules":

    PROGRAM!="check_gui_user_group.sh gnome-session myusbaccessgroup", GOTO="libmtp_rules_end"
    

    For Ubuntu 14.04 Unity & Gnome, you may use gnome-session. For other desktops, check using pstree -u or ps aux | grep -i session

    The meaning of the rule: Whenever the user of gnome-session is NOT in the myusbaccessgroup group skip all libmtp rules.

  4. PTP devices: Add another rules file

    nano /etc/udev/rules.d/99-usb-storage-remove.rules
    

    Add rule

    ACTION=="add", ENV{GPHOTO2_DRIVER}=="PTP", ENV{DRIVER}!="", PROGRAM!="check_gui_user_group.sh gnome-session myusbaccessgroup", RUN+="/bin/sh -c 'echo -n %k >/sys%p/subsystem/drivers/%E{DRIVER}/unbind'"
    
  5. Other USB storage devices: Add this rule to the rules file of the previous step.

    ACTION=="add", DRIVER=="usb-storage|uas|ums-*", PROGRAM!="check_gui_user_group.sh gnome-session myusbaccessgroup", RUN+="/bin/sh -c 'echo -n %k >/sys%p/driver/unbind'"
    

    To know from where I get the list of drivers, try this:

    ls /lib/modules/$(uname -r)/kernel/drivers/usb/storage/
    
  6. Reload the rules

    udevadm control -R
    
  7. Replug your phone.


Testing & Troubleshooting:

  1. Setup the group, if it's not already done

    addgroup myusbaccessgroup
    
  2. Remove user from the group.

    deluser user myusbaccessgroup
    
  3. Run udev monitor

    udevadm monitor -u
    
  4. Replug that device

  5. Check what was run

    udevadm test /sys/device/...
    
  6. Add user to the group

    adduser user myusbaccessgroup
    
  7. Redo starting from step 3.

Notes:

I used Kubuntu 15.04 (real machine) and Ubuntu 14.04 (fresh install in VirtualBox) for testing.

  • I used Wiko Bloom (Android 4.4.2) to test MTP mode which works well in both systems.
  • I couldn't test PTP mode because it wasn't auto-mounted, May be I'm missing something here.
  • Other external storages: a flash disk & an external hard drive. Test passes for both systems.

References:

  • 1
    Is that export GUI_$(... supposed to be export GUI_USER=$(? Also, instead of looping over groups, you could just grep: groups $GUI_USER | grep -qFw "$2" – muru Sep 16 '15 at 15:19
  • @muru, USER= is already in grep -z command, yes that's simpler. thank you – user.dz Sep 16 '15 at 15:53
  • 1
    The brand new android 5.0 device gets mounted without a line in libmtp.rules. Also it does with usb-devices. When I removed usb-devices.ko it still got mounted with usbfs. – Pilot6 Sep 16 '15 at 16:41
  • 1
    @Sneetsher, I will try your solution out tomorrow (can't today) and get back to you. If it works well for the few MTP devices I have, I'll mark this as the answer. Please let me know if you have a better answer using Pilot6's comments about using usb-storage. In the mean time, can you guys think of other ways a device can connect to ubuntu? Like PTP/UMTS etc? It doesn't even have to be a phone per say. I'm trying to disable any external input and outputs using the USB here. – Akshay Rao Sep 16 '15 at 17:57
  • 1
    I thought same and I have the same problem. I never dealt with it. I was hoping someone knows how to do it. – Pilot6 Sep 16 '15 at 20:46
3

I had the same requirement in my end .

Best way to Block MTP,PTP for android is to disable the service in ubuntu .

Enter this location as root /usr/lib/gvfs

"sudo nautilus" will be easy if you tend to use GUI

"sudo nautilus" and the n navigate to computer/usr/lib/gvfs

There will be list of services Remove the execute permission by right clicking the appropriate service-->properties-->permission-->unckeck "execute" and change the read only access from "read only" to "none"

Blocking MTP and PTP

Remove the execute permission for

gvfsd-mtp

gvfs-mtp-volume-monitor(for safer side)

gvfsd-gphoto2

gvfs-gphoto2-volume-monitor(for safer side)


Apple I phone can mount through afp

so kindly Remove the execute permission for gvfsd-afp

gvfs-afc-volume-monitor(for safer side)

some android mobiles can use mass-storage mode to mount there SD card change the folder permission in /media/user to 400

user- the created user in ubuntu.

chmod 400

or remove the mount permission for user..

  • Thank you! Works like a charm on Ubuntu 16.04. Just note that you need to reboot to see the change. – Gene Vincent Sep 30 '17 at 15:23
  • hardcore approach which only works when having root access, but it works, thank you. – mxmlnkn Nov 17 '17 at 10:34
0

This should work for both Unity & Gnome, tested in Ubuntu 14.04.

  1. Add the new group

    addgroup myusbaccessgroup
    
  2. Change the owner group of gvfs monitors

    chown root:myusbaccessgroup /usr/lib/gvfs/gvfs-*-monitor
    
  3. Remove permission to read & execute for public/others

    chmod 750 /usr/lib/gvfs/gvfs-*-monitor
    
  4. Put user1 in the group & leave user2 out or remove it from the group

    adduser user1 myusbaccessgroup
    deluser user2 myusbaccessgroup
    
  5. Logout

  • This did not work. The phone still gets mounted with usbfs. – Pilot6 Sep 18 '15 at 15:49
  • :( out of ideas, It hit the wall. BTW, @Pilot6 are using Ubuntu 14.04/Unity? – user.dz Sep 20 '15 at 13:38
  • I use default 14.04 LTS with unity. But it does not matter much I guess. – Pilot6 Sep 20 '15 at 15:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.