On Sun, 21 Apr 2002, H. Peter Anvin wrote:

> Peter Toft wrote:
> > Hi there 
> > 
> > I can see from 
> > http://www.linux.org/apps/AppId_2476.html that you are 
> > the maintainers of the fine autofs package for Linux. I 
> > really like it and I have one question regarding 
> > mounting devices as an ordinary user. I would like to 
> > mount a device as the user foo so that foo owns the 
> > device (it is for a USB memory-stick device)
> > 
> > If I add this line to my /etc/fstab
> >   /dev/sda1 /mnt/usb auto noauto,owner,user,rw 0 0
> > 
> > then user foo can run "mount /mnt/usb" and likewise
> > "umount /mnt/usb" and here foo has full ownership 
> > and read+write access over "/mnt/usb".
> > 
> > Then I turn to autofs and like to have the same 
> > permissions for the user foo
> > 
> 
> There are horrible security hazards with this, because anyone can come 
> in and access the autofs directory.  The right thing to do is to use the 
> "owner" flag instead, and set up your login system so that the console 
> user owns the removable devices, such as /dev/sda* in your case.

Dear Peter (BTW; Hans Peter sounds very Danish - any 
relatives there?)

I acknowledge the security issues, but my focus is 
the user on a stand-alone computer, not the 
network-box. My knowledge about permissions, 
network-hacks etc. is fine - I have written 11 books 
about Linux :)

I have tried to read the README* files in the source 
without any luck. Could you guide me how to set this 
owner flag?

I have tried to add to /etc/auto.misc a line
  usb -fstype=auto,owner :/dev/sda1
but this will still leave /misc/usb owned by root:root

I can do the 
  usb -fstype=auto,uid=500,gid=500 :/dev/sda1
but this will only give user #500 the 
read/write-access. Assume that we like my wife, kid, 
and dog :) to have writeaccess - whoever mounts the 
device (typically a vfat formatted device).

Best regards (have joined the mailing list now)

-- 
Peter Toft, Ph.D. [[EMAIL PROTECTED]] http://www.sslug.dk/~pto

Check your back - penguins approaching.....






Reply via email to