Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying create a line in /etc/sudoers that allows members of group "users" to mount cifs shares anywhere inside their own home directory. In my first attempt I tried:

%users ALL=/bin/mount -t cifs /home, /bin/umount /home

...which admittedly doesn't restrict them to their own home directory. As a user when I try the command:

sudo mount -t cifs ~/mount //hostname/sharename -o username=myuserid,domain=mydomain

...I get prompted for the password then receive error:

Sorry, user myuserid is not allowed to execute '...command...' as root on servername.

Is there any way to coerce sudoers to specify what I want?

share|improve this question

migrated from stackoverflow.com Jan 16 '11 at 5:16

This question came from our site for professional and enthusiast programmers.

I figured out how to do it, less the restriction that you are in your own directory:

%users localhost, hostname = NOPASSWD: /bin/mount -t cifs //*/* /home/* -o username=*, /bin/umount /home/*

Does anyone have an idea how to restrict a user to hiw own home directory?

share|improve this answer
does this work?? – user1850133 Jul 11 '14 at 19:09

You might be better off giving your users the ability to use FUSE filesystems to mount their cifs shares.

share|improve this answer

It's worth noting that some recent versions of mount.cifs fail unless the mount point is in /etc/fstab, even if they are installed setuid, so I would expect your sudo approach to fail with those versions.



As an alternative, you might try one of these:



share|improve this answer

I'm not sure why your requirement must allow users to mount the devices anywhere in their home directory. Security to keep the device private to them I suppose?

Anyways, if you can handle having public,static mount points you could add entries to /etc/fstab for the cifs shares and add the "users" attribute to let users mount/unmount them.

The line would look something like this:

//host/share /mount/point cifs users,rw,username=xxx,password=xxx 0 0

See http://www.tuxfiles.org/linuxhelp/fstab.html

I realize this doesn't solve the exact issue you presented but maybe it gives you some ideas for a compromise.

share|improve this answer
This isn't a very good option for us because we don't know what share they are trying to mound in advance, and because it looks like it requires us to hard-code their AD password into fstab. That's why I'm looking for something more interactive like sudo. – scott8035 Jan 14 '11 at 19:04
understandable. The issue of passwords showing up in /etc/fstab could be avoided with cyberciti.biz/faq/access-windows-shares-from-linux but the main problem still exists. – gravitron Jan 14 '11 at 19:08
You don't need to hardcode credentials in /etc/fstab if you use option credentials= pointing to a file (man mount.cifs). Still it doesn't allow to choose the username, only to protect credentials. – 9000 Jan 16 '11 at 21:58

I can't help but think of pam_mount solving half of the puzzle already by giving users the ability to mount such networked volumes on start of a session.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.