Set removable media (USB drive) permissions to a specific group

Question

The scenario is: my company is trying to block users from writing to USB sticks as a data security measure. But there's a catch. Users that belong to a specific group (let's say "usbwriters"), should be able to write data to removable USB media.

It's important that the user experience of the modern desktop enviroments shouldn't be impacted, so, the process must be transparent to the user. When he plugs the drive, it must automount, diplay the default notifications (as in gnome, for example), etc.

What I've done so far: I've changed udev/rules.d/ and added the following:

SUBSYSTEM=="block",ACTION=="add",ATTRS{removable},OWNER="root",GROUP="usbwriters",MODE="0464",RUN{program}="/sbin/blockdev --setro %N"

Great. I guess that's half the way. Now any user that plug an USB drive will get it mounted as read only. The problem is I need the users in the "usbwrites" group to be able to mount it as writable (read/write).

I tried setting and UDEV rule that would RUN udisks passing the --options group=usbwriters (or gid=XXXX), but I get an error: "GDBus.Error:org.freedesktop.UDisks2.Error.OptionNotPermitted".

Then I concluded I'm not supposed to do that, there must be a better way.

Could you guys help me? Shouldn't that be simple?

Answer 1

First thing that comes to mind: All USB block devices get owner=root, group=usbwriters, mode=660. That prevents users not in that group from writing blocks directly.

Then figure out some scheme that lets user of this group actually mount the filesystem on the USB stick, no matter if it's FAT or something else. For example, by using usbmount with mountpoints in a directory with appropriate permissions, or whatever you are using to automatically mount USB sticks.