0

Context: I'm playing with Python and Shell script trying to create a simple app to run with dmenu to mount/unmount drives.

My problem currently is in the fact that the command to mount the drive is in the shell script file, and this command requires root permission to run.

The part where things go wrong is precisely this one:

mount ${DRIVE} ${DESTINATION}

I've done a bit of research and most answers to the "run mount without sudo" issue point to editing the fstab file and manually add the disks.

I would like to know if there is another way, without making the user edit system files/configurations. Or at least get this configuration done automatically.

2

You need some way to restrict the possible parameters to the mount command the users can use, or else a malicious user could easily take over the system by mounting something over /etc so that the system uses the attacker's version of /etc/shadow instead of the real one. The effect would be as if the attacker got to temporarily replace the passwords of any and all users with password(s) known to the attacker.

If the users need only to mount/unmount a fixed set of filesystems to a fixed set of mount points, just adding them to /etc/fstab using the user or users mount option might be a valid solution.

If you cannot predict the device name the user needs to mount, or the user needs to be able to mount it to an arbitrary location that is accessible to him/her, your problem is harder. Perhaps allow the user to mount the filesystem to a fixed location only, and then teach the user to use ln -s /actual/mount/point /desired/location to create symlinks to make the files appear where they are needed?

  • Just noticed that this can be achieved using udisks2. It will mount the drives to /run/media/{username}, which is precisely what file managers like Thunar do. Since it doesn't mount to /etc, I think it is pretty safe, right? – Renato Oliveira May 16 '18 at 11:07
  • 1
    Yes, that is safe. – telcoM May 16 '18 at 16:31
1

You could edit user permission file and grant that user to use mount.

Use visudo and add a line like this (changing that user_name for your own user)

user_name ALL=NOPASSWD: /bin/mount
0

The easier and safer answer to this question is to use udisks2 instead of mount directly. It is used by file managers like Thunar, and do not require root privileges. The tool mounts the drives on /run/media/<username>/.

To mount a drive use udisksctl with mount:

udisksctl mount -b /dev/sdbX

Use unmount to unmount.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.