This question is related to another, more general, question about guest accounts. This one is very specific.

Setup: I have many older Dell Latitude E6410s and some newer Dell Latitude 5450 I use in a classroom setting running 16.04. Many students use these machines for a variety of purposes among data analysis and data acquisition through attached USB devices.

Guest accounts serve us well to wipe the machines clean between logins. The additional feature of the guest accounts is that upon turning the machines on and 'forgetting' them the machine automatically log in to the guest account and launch a browser window. The problem is that the guest accounts do not have any privileges to access the USB ports.

A simple solution would be to add the new guest account (e.g guest-abf2) to the dialout and plugdev group so the students can use attached devices and thumb drives. Something like:

moduser -a -G plugdev,dialout $USER

inside a script early enough in the login process to work.

This is what I have tried so far:

  • placing this command in either of the two documented hooks: auto.sh and prefs.sh in the /etc/guest-session directory. Neither works. prefs.sh is run in the user context and while auto.sh is supposed to run in root context it is run too late to add the newly created guest account to the two groups
  • modifying the available scripts the lightdm runs (Yeah I know this is not good but I was getting desperate) and still this doesn't work. I need to execute the moduser command right after the account is created but before the actual login.
  • According to old documentation (11 or so) there is a hook called setup.sh which I tried but I am not sure this hook works anymore.
  • I have looked into writing a udev script but that seems terribly painful and the documentation seems geared toward mounting USB thumb drives not allowing access to USB devices. I could be wrong here.
  • Somewhere I tripped across some documentation that there was a similar 'script' like mechanism to automatically add new users to certain groups but I can't seem to find it. This might work in this case or not but I'll give it a try.
  • The guest account is restricted by apparmor as well, so, IMHO, if you want to add functionality you may need to debug apparmor also. IMHO it may be easier to add a "normal" user then modify the guest. Also changes to the guest account are not kept at log out. See help.ubuntu.com/16.04/ubuntu-help/shell-guest-session.html and help.ubuntu.com/community/CustomizeGuestSession for details / advice. – Panther May 12 '16 at 2:13
  • @bodhi.zazen: Thank you. I have a 'special user' account mentioned in your suggestion which manages a link to a 'skel' directory. This is how I manage the features I want the students to experience. That much works well. The fact that everything is deleted at the end is, in fact, the desirable feature. I may, indeed, have to resort to creating a 'normal' user account with an exit script which wipes everything. – pbeeken May 12 '16 at 15:29

The guest accounts are created by the shell script /usr/sbin/guest-account.

At the end of the function add_account it calls useradd to create the user. If you add the -G plugdev,dialout option here that should do the trick.

Use dpkg-divert to avoid that an updated package overwrites your modified script.

  • Don't forget the limitations of the guest account and the fact that the guest account is restricted by apparmor. – Panther May 12 '16 at 2:13
  • @Florian: I did try modifying /usr/sbin/guest-account without success but I think rather than add the options I followed the adduser command with the moduser command. I'll try again with your suggestion. bodhi may have a point about apparmor. In the logs, apparmor is very busy during guest account setup. I haven't explored that cave of snakes ;-) Thanks for the suggestions. – pbeeken May 12 '16 at 15:35
  • @Florian: You are de man! It worked. OK I modded a script that could get overwritten but I can live with that. AppArmor might have caused problems (good call, bodhi) but it doesn't seem to in this case. I can access the hardware and now read and write to USB thumb drives. The individual laptops are not updated in isolation. I update one and use its drive as a template that gets cloned out to the others on a schedule I set. So I can live with this solution. Thank you, everyone. – pbeeken May 12 '16 at 16:00
  • @pbeeken: Great that you made it work. But I have a feeling that you actually found a bug which should be fixed. Especially you shouldn't need to mess with the package owned /usr/sbin/guest-account to be able to write to a USB thumb drive. I'm going to ask the lightdm developer about this. – Gunnar Hjalmarsson May 12 '16 at 18:35

Use usermod, not 'moduser'.

... so the behavior of the startup script prefs.sh now works as advertised. By creating a file called prefs.sh in /etc/guest-session with the following line:

moduser $USER -a -G plugdev,dialout

That command will cause the guest session to crash and not load if you include it in prefs.sh. '`moduser' isn't a valid command. Use this line instead:

usermod -a -G plugdev,dialout $USER

auto.sh has never run in a root context. prefs.sh did so up to Ubuntu 15.10 when it was sourced by /usr/sbin/guest-account, but the code has been refactored, and in 16.04 prefs.sh is sourced by /usr/share/lightdm/guest-session/setup.sh which is not run as root.

Don't know if this change in behavior is intentional. If not, there may be a reason to propose a change.

Not sure what you mean when you say that a guest session cannot access the USB ports. I know that you can use USB sticks, at least. Possibly there are other devices whose use is prevented via AppArmor.


I filed a bug report, and if accepted, you will be able to use prefs.sh to assign the guest to group(s) as you could before.

As regards USB sticks I did some testing, and found that how the stick is formatted matters. With an ext4 formatted stick I could neither read nor write, but when formatted as fat16 it works fine.

  • Thanks. I discovered as much. The system for changing permissions of the guest account worked well in 14.04LTS and seemed to break in 16.04. I agree, it may very well be that 14.04 was the mistake and now it is working as intended. I did see how prefs.sh was run in /usr/sbin/guest-account as local user. Your response does answer my more general query[askubuntu.com/questions/766942/… I may copy it to that one crediting you as the responder (once I figure out how to do that). – pbeeken May 12 '16 at 15:42
  • As for access to 'thumb drives' that behavior is also funny. I can read from thumb drives from the guest account but not write. I suspect that is controlled from a udev script. That is phase 2. All our students primary storage system is Google Drive. Thanks for your answer. – pbeeken May 12 '16 at 15:47
  • @pbeeken: Please see my comment under Florian's answer. ( The credit for my answer isn't important to me. ;) ) – Gunnar Hjalmarsson May 12 '16 at 18:39
  • I too noticed the finicky behavior with formatting. Most of the saves are to Google but occasionally they have FAT32 and FAT16 drives. Sometimes the system allowed r/w sometimes not. Now it is consistent.I haven't deployed 16.04 to the other machines yet (we are settling on some other software) so if the fix comes down the pipe I'll put the command back into prefs.sh where it belongs. Thanks. – pbeeken May 20 '16 at 3:21
  • @pbeeken: It was approved by the maintainer, so the fix will be included in the next lightdm update in Ubuntu 16.04. (Can't tell exactly when it will happen.) – Gunnar Hjalmarsson May 23 '16 at 11:28

I don't know exactly when it happened but lightdm was updated so the behavior of the startup script prefs.sh now works as advertised. By creating a file called prefs.sh in /etc/guest-session with the following line:

moduser $USER -a -G plugdev,dialout

I achieved exactly what I needed to allow students to access new USB devices in the guest account.

  • It happened on July 13. Can you please accept your own answer so it's showed first, to make it easier for others who find your question. – Gunnar Hjalmarsson Aug 19 '16 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.