Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm trying create a line in /etc/sudoers that allows members of group "users" to mount cifs shares anywhere inside their own home directory. In my first attempt I tried:

%users ALL=/bin/mount -t cifs /home, /bin/umount /home

...which admittedly doesn't restrict them to their own home directory. As a user when I try the command:

sudo mount -t cifs ~/mount //hostname/sharename -o username=myuserid,domain=mydomain

...I get prompted for the password then receive error:

Sorry, user myuserid is not allowed to execute '...command...' as root on servername.

Is there any way to coerce sudoers to specify what I want?

share|improve this question
add comment

migrated from stackoverflow.com Jan 16 '11 at 5:16

This question came from our site for professional and enthusiast programmers.

5 Answers

I'm not sure why your requirement must allow users to mount the devices anywhere in their home directory. Security to keep the device private to them I suppose?

Anyways, if you can handle having public,static mount points you could add entries to /etc/fstab for the cifs shares and add the "users" attribute to let users mount/unmount them.

The line would look something like this:

//host/share /mount/point cifs users,rw,username=xxx,password=xxx 0 0

See http://www.tuxfiles.org/linuxhelp/fstab.html

I realize this doesn't solve the exact issue you presented but maybe it gives you some ideas for a compromise.

share|improve this answer
    
This isn't a very good option for us because we don't know what share they are trying to mound in advance, and because it looks like it requires us to hard-code their AD password into fstab. That's why I'm looking for something more interactive like sudo. –  scott8035 Jan 14 '11 at 19:04
    
understandable. The issue of passwords showing up in /etc/fstab could be avoided with cyberciti.biz/faq/access-windows-shares-from-linux but the main problem still exists. –  gravitron Jan 14 '11 at 19:08
    
You don't need to hardcode credentials in /etc/fstab if you use option credentials= pointing to a file (man mount.cifs). Still it doesn't allow to choose the username, only to protect credentials. –  9000 Jan 16 '11 at 21:58
add comment

I figured out how to do it, less the restriction that you are in your own directory:

%users localhost, hostname = NOPASSWD: /bin/mount -t cifs //*/* /home/* -o username=*, /bin/umount /home/*

Does anyone have an idea how to restrict a user to hiw own home directory?

share|improve this answer
add comment

You might be better off giving your users the ability to use FUSE filesystems to mount their cifs shares.

share|improve this answer
add comment

I can't help but think of pam_mount solving half of the puzzle already by giving users the ability to mount such networked volumes on start of a session.

share|improve this answer
add comment

It's worth noting that some recent versions of mount.cifs fail unless the mount point is in /etc/fstab, even if they are installed setuid, so I would expect your sudo approach to fail with those versions.

http://fedoraforum.org/forum/showthread.php?p=1329591

https://bugs.launchpad.net/ubuntu/+bug/657900

As an alternative, you might try one of these:

SMBNetFS

FuseSMB

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.