When I plug in a USB drive it is automatically mounted on /run/media/user/fslabel
. This is done, I guess by some udev/dbus/thunar/nautilus/gvfs or other system, and I find this convenient and do not want to revert to manual mounting by root. However, I have a problem with the default mount options: vfat drives are mounted such that the executable flag ist set on all regular files. This is a nuissance and a security problem and I wish to disable it.
How do I set system-wide options for mounting, like using the noexec
flag for all vfat
partitions and disabling mounting of ext4
partitions by user-space programs/daemons?
A few years ago I tried something very time-consuming on a different system, like editing some udev
or dbus
rules (quite apparently not files designed to be edited by hand), which was a great effort due to lack of proper documentation and great variation between distros. Is this the intended and only way? If so, could someone please tell me what to change where?
I am using Arch Linux, CentOS and openSUSE with the XFCE Desktop. Automount may be performed by one of nautilus, thunar or dolphin, running in the background (or possibly, a service started by these?!). I am not sure because it happens in the background.
rsync
ing /cp -p
ing files to my own filesystem so that suddenly I have thousands of executable files which may even be writable to group/others (again due to mount options I did not set). I do consider this a security risk - but then this question was no question on security. – Ned64 Jun 14 '15 at 15:37/usr/bin/mount.vfat
script is executed. By the looks of it, you could manually edit that file to add whichever options you like. – Bridgey Jun 18 '15 at 16:48/usr/lib/udisks2/udisksd
is running asroot
. This in turn is apparently automatically started bydbus-daemon
. I am pretty sure one of them can be configured (e.g. with entries in/lib/udev/rules.d/
, I think that is what I did last time --/lib/udev/rules.d/80-udisks.rules
?). wiki.archlinux.org/index.php/Udisks also has some hints, and I will dig deeper - unless someone knows the next steps? - - - - As to the second question, no, I meant external ext[34] and LUKS partitions (the user gets a password prompt?!). – Ned64 Jun 23 '15 at 18:24