The scenario is: my company is trying to block users from writing to USB sticks as a data security measure. But there's a catch. Users that belong to a specific group (let's say "usbwriters"), should be able to write data to removable USB media.
It's important that the user experience of the modern desktop enviroments shouldn't be impacted, so, the process must be transparent to the user. When he plugs the drive, it must automount, diplay the default notifications (as in gnome, for example), etc.
What I've done so far: I've changed udev/rules.d/ and added the following:
SUBSYSTEM=="block",ACTION=="add",ATTRS{removable},OWNER="root",GROUP="usbwriters",MODE="0464",RUN{program}="/sbin/blockdev --setro %N"
Great. I guess that's half the way. Now any user that plug an USB drive will get it mounted as read only. The problem is I need the users in the "usbwrites" group to be able to mount it as writable (read/write).
I tried setting and UDEV rule that would RUN udisks passing the --options group=usbwriters (or gid=XXXX), but I get an error: "GDBus.Error:org.freedesktop.UDisks2.Error.OptionNotPermitted".
Then I concluded I'm not supposed to do that, there must be a better way.
Could you guys help me? Shouldn't that be simple?