4

I'm trying create a line in /etc/sudoers that allows members of group "users" to mount cifs shares anywhere inside their own home directory. In my first attempt I tried:

%users ALL=/bin/mount -t cifs /home, /bin/umount /home

...which admittedly doesn't restrict them to their own home directory. As a user when I try the command:

sudo mount -t cifs ~/mount //hostname/sharename -o username=myuserid,domain=mydomain

...I get prompted for the password then receive error:

Sorry, user myuserid is not allowed to execute '...command...' as root on servername.

Is there any way to coerce sudoers to specify what I want?

migrated from stackoverflow.com Jan 16 '11 at 5:16

This question came from our site for professional and enthusiast programmers.

2

I figured out how to do it, less the restriction that you are in your own directory:

%users localhost, hostname = NOPASSWD: /bin/mount -t cifs //*/* /home/* -o username=*, /bin/umount /home/*

Does anyone have an idea how to restrict a user to hiw own home directory?

  • does this work?? – user1850133 Jul 11 '14 at 19:09
1

You might be better off giving your users the ability to use FUSE filesystems to mount their cifs shares.

1

It's worth noting that some recent versions of mount.cifs fail unless the mount point is in /etc/fstab, even if they are installed setuid, so I would expect your sudo approach to fail with those versions.

http://fedoraforum.org/forum/showthread.php?p=1329591

https://bugs.launchpad.net/ubuntu/+bug/657900

As an alternative, you might try one of these:

SMBNetFS

FuseSMB

0

I'm not sure why your requirement must allow users to mount the devices anywhere in their home directory. Security to keep the device private to them I suppose?

Anyways, if you can handle having public,static mount points you could add entries to /etc/fstab for the cifs shares and add the "users" attribute to let users mount/unmount them.

The line would look something like this:

//host/share /mount/point cifs users,rw,username=xxx,password=xxx 0 0

See http://www.tuxfiles.org/linuxhelp/fstab.html

I realize this doesn't solve the exact issue you presented but maybe it gives you some ideas for a compromise.

  • This isn't a very good option for us because we don't know what share they are trying to mound in advance, and because it looks like it requires us to hard-code their AD password into fstab. That's why I'm looking for something more interactive like sudo. – scott8035 Jan 14 '11 at 19:04
  • understandable. The issue of passwords showing up in /etc/fstab could be avoided with cyberciti.biz/faq/access-windows-shares-from-linux but the main problem still exists. – gravitron Jan 14 '11 at 19:08
  • You don't need to hardcode credentials in /etc/fstab if you use option credentials= pointing to a file (man mount.cifs). Still it doesn't allow to choose the username, only to protect credentials. – 9000 Jan 16 '11 at 21:58
0

I can't help but think of pam_mount solving half of the puzzle already by giving users the ability to mount such networked volumes on start of a session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.