3

I am running Debian on different machines (Debian Buster, same installation in all machines). I am using internal and external HDD. Some disks are encrypted others no.

When I mount a disk, some machines ask me for the user password to mount the disk (Sudoer account). Other machines ask me for the root/ Admin password (even if I am in a sudoer account). Even one machine asked me for another sudoer account's password (link). Some machines do not ask for password to mount the disk (only for the decryption password for encrypted disks).

Where is the configuration file where decides what account's password to use?

4
  • 1
    Are you a sudoer in the same way in all these systems? If the GUI prompts you, it likely prompts for polkit authorization, and polkit config need not have anything to do with sudo config (though on Ubuntu, at least, then sudo group grants admin access in both).
    – muru
    Mar 29, 2021 at 15:00
  • Thanks for your answer. All systems should have me as a sudoer in the same way, since I always do the same to grant sudo. Said that I guess it doesn't hurt if I try to compare them? When you say the 'same way" are you thinking in anything, in particular, I should compare?
    – daniel_hck
    Mar 29, 2021 at 15:07
  • 1
    When I say the same way, I mean what in sudoers makes you an admin? Is it your username that you add to it? Or do you add yourself to a custom group that you then put in sudoers? Or do you add yourself to the sudo or wheel or admin (or ...) group which is already granted privileges in sudoers?
    – muru
    Mar 29, 2021 at 15:28
  • oh. So many ways... I always invoke root as 'su' then use 'sudo visudo' and add my username "daniel ALL=(ALL:ALL) ALL". So, I guess all the systems have the same way.
    – daniel_hck
    Mar 29, 2021 at 17:20

3 Answers 3

5

Mounting in GUI is done by UDisks, it's a daemon that runs as root and uses polkit to decide who can a cannot mount (or do other operations like unlocking an encrypted device) a block device. Some mount operations can be done by any user in a active session, some require administrator privileges. For example UDisks allows to mount a removable device by "normal" users, but requires an administrator to mount a non-removable (internal) device.

Administrator in polkit does not mean user that can use sudo, polkit doesn't check /etc/sudoers, to be an administrator, user must be in a specific group. It's usually the same group that grants sudo, but this doesn't work if you add the user to sudoers manually.

In Fedora administrators are defined as users in the wheel group, you'll find this either in the polkit manpage or in /etc/polkit-1/rules.d/50-default.rules:

Define administrative users to be the users in the wheel group:

      polkit.addAdminRule(function(action, subject) {
          return ["unix-group:wheel"];
      });

If you are not an administrator and you ask for a privileged operation (like mounting a non-removable drive), polkit agent will ask you for password of a different user who is an administrator. For example KDE agent will ask you to select a user, but IIRC Xfce agent just picks a user for you and asks for his password. Default behaviour depends on the agent you are using. Interestingly, polkit agent will prefer user in an active session even when you try to use different administrator account from a terminal -- running sudo -u <user> udisksctl unlock -b /dev/sda1 will ask for passphrase of user logged in in the GUI session.

tl;dr

  • UDisks (its polkit rules) decides whether you'll be asked for administrator password or not.
  • Polkit agent decided whose password it will be. It should prefer user in the active session (if it is administrator account).
1
  • Thank you so much! I really enjoyed your explanation! So, from your post, even all my main accounts are sudoers, some of my accounts might be in the admin group, whereas other don't. I will check that!!
    – daniel_hck
    Mar 29, 2021 at 20:32
3

You did not say how you mount disks. Generally unices/Linux use file representation for block devices and these files have user/group and permission.

ls -l /dev/dm-*
brw-rw---- 1 root disk 254, 0 Mar 21 18:33 /dev/dm-0
brw-rw---- 1 root disk 254, 1 Mar 21 18:33 /dev/dm-1
brw-rw---- 1 root disk 254, 2 Mar 21 18:33 /dev/dm-2
brw-rw---- 1 root disk 254, 3 Mar 21 18:33 /dev/dm-3

If you are 'root', or in 'disk' group you have read/write.

Of course other ways to mount block devices hide this from the user. Various GUI apps use polkit (and authorize calling user), then in the background the action is done as 'root'. sudo way is to give a user possibility to make privileged actions. But basically all is about permissions on files representing block devices in /dev.

3
  • How I mount disks? I just click the disk in Files. Ok, I will check the groups in the accounts. Can you clarify the sentence 'or in 'disk' group you have read/write'. Is there a group call 'disk'? or a system username? What is the dm?
    – daniel_hck
    Mar 29, 2021 at 17:39
  • See en.wikipedia.org/wiki/… You need basic UNIX education; the output below is specific to a Linux distribution used, other distributions could have different owner/group.
    – Jiri B
    Mar 29, 2021 at 18:26
  • Sure, I have to refresh some concepts... Ok, basically I will look if all my usernames are in either sudo, root, or disk groups
    – daniel_hck
    Mar 29, 2021 at 19:54
-1

Debian Disk Manager was asking me for a password I didn't have. I opened a terminal, typed sudo -i then disk-manager and access was granted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .