I am using pam_mount to mount cifs and sshfs shares for users when they log in to an Arch Linux workstation. I have the a volume line in /etc/security/pam_mount.conf.xml:

<volume user="strongbad" fstype="fuse" path="sshfs#%(USER)@myserver.com:" mountpoint="/mnt/%(USER)" options="idmap=user,password_stdin" />

Everything works great on log in and I get an entry in /proc/mounts:

strongbad@myserver.com: /mnt/strongbad fuse.sshfs rw,nosuid,nodev,relatime,user_id=1002,group_id=1002 0 0

The problem is the shares do not get unmounted when the user logs out. I hae tried logging in with both KDE/KDM and directly to a TTY. I get the same error in the system logs no matter how I log in:

systemd[474]: (pam_mount.c:706): received order to close things

systemd[474]: (pam_mount.c:538): * PAM_MOUNT WAS INVOKED WITH INSUFFICIENT PRIVILEGES (euid=1002)

systemd[474]: (pam_mount.c:539): * THIS IS A BUG OF THE CALLER. CONSULT YOUR DISTRO.

systemd[474]: (pam_mount.c:540): * Also see bugs.txt in the pam_mount source tarball/website documen

Taking a look at bugs.txt uninformatively, at least to me, says:

== su, probably others — privilege drop ==

I sometimes get reports about unmount failing because of insufficient privileges. Some programs and/or distributions and/or pam configurations seem to drop the root privileges after successful authentification. This goes counter to pam_mount which needs these privileges for umount. (May not apply for FUSE mounts.)

Known constellations include

  • su from coreutils, on some distros

  • GDM on Ubuntu

This seems to describe my problem. Am I doing something wrong? Is Arch broken? Are there any distributions where pam_mount is actually able to unmount shares on logout?

  • Where do you have pam_mount.so in your pam stack? Is it in session? The man page for pam_close_session(3) (which is what gets called to invoke the session group) explicitly says "It should be noted that the effective uid, geteuid(2). of the application should be of sufficient privilege to perform such tasks as unmounting the user´s home directory for example." Meaning if some utility is dropping perms, that's a serious bug in that utility. To answer your latter questions about distros where pam_mount works, I run gentoo and use it without any issues, including unmount. – Patrick May 21 '14 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.