В Fri, 13 Feb 2015 10:24:39 -0600
Paul Novak <k9jen...@gmail.com> пишет:
>
> >> System devices require authentication for
> >> org.freedesktop.udisks2.filesystem-mount-system action; other devices -
> >> for org.freedesktop.udisks2.filesystem-mount. Check whether polkit
> >> grants you it:
>
> Running as non-root user,
>
> pkcheck -a org.freedesktop.udisks2.filesystem-mount-system -p $$
>
> returns no visible output, so running
>
> echo $?
>
> returns 0
>
> I believe this means that polkit is granting permission to me (non-root
> user)
>
Correct.
>
> I went to the
>
> <action id="org.freedesktop.udisks2.filesystem-mount-system">
>
> section, and changed
>
> <allow_active>yes</allow_active>
> to <allow_active>auth_admin</allow_active>
>
> towards the end of the section.
>
> I rebooted (I wasn't sure if I needed to but I just wanted to be sure).
> I (non-root) could still mount ROOT3 using the KDE device notifier
> and running "udisksctl mount -b /dev/sda1" on the command line.
>
This file sets default policy. There could be other settings that
change it. E.g. I have in /etc/polkit-1/rules.d/90-default-privs.rules
'org.freedesktop.udisks2.filesystem-mount-system':
[ 'auth_admin', 'auth_admin', 'auth_admin_keep' ],
check /etc/polkit-1/rules.d and /usr/share/polkit-1/rules.d
You can also simply create additional file to override these settings.
>
> - is udisks supposed to ignore the "nouser" setting in /etc/fstab
> and just go by whatever polkit tell it?
>
> - do I need to reboot after changing
> /usr/share/polkit-1/actions/org.freedesktop.udisks2.policy
>
You need to restart polkit daemon
> - even if ROOT3 were not set to "nouser", why am I (non-root)
> allowed to mount ROOT3 using udisksctl even after I set every
> occurance of <allow_active> to auth_admin?
>
> Paul.
> *
>
>
> On Fri, Feb 13, 2015 at 12:24 AM, Andrei Borzenkov <arvidj...@gmail.com>
> wrote:
>
> > В Thu, 12 Feb 2015 11:59:40 -0600
> > Paul Novak <k9jen...@gmail.com> пишет:
> >
> > > I'm trying to track down what I think is a bug that
> > > can be seen using the KDE device notifier (although
> > > according to the KDE folks, the problem in either in
> > > udisk or polkit (either a bug or misconfiguration).
> > >
> > > I'm just a user; I'm not a developer.
> > >
> > > Before I write a bug report, I'm asking for confirmation
> > > that what I'm seeing is in fact a bug and not expected/
> > > desired behavior.
> > >
> > > I have verified this issue running LiveDVDs of
> > > Kubuntu, Mint, and PCLinuxOS. I used LiveDVDs
> > > to eliminate any possibility of the problem
> > > being related to my personal computer.
> > >
> >
> > Live DVDs could intentionally loosen permission checks. After all you
> > are supposed to be the sole user and cannot interfere with anything.
> >
> > > I have many partitions on my primary hard drive that
> > > are not normally mounted. One of them (for example)
> > > is LABEL-ed ROOT3 and I have an entry in /etc/fstab
> > > that looks like this:
> > >
> > > LABEL=ROOT3 /mnt/ROOT3 ext4 noauto,nouser,ro 1 2
> > >
> > > I don't want non-root users to be able to mount or unmount
> > > that partition, so I have set the "nouser" attribute.
> > >
> > > In a (non-root) terminal, if I run
> > >
> > > mount /mnt/ROOT3
> > >
> > > I will (correctly) get this error:
> > >
> > > mount: only root can mount LABEL=ROOT3 on /mnt/ROOT3
> > >
> > > However, if I (non-root user) click on the KDE Device Notifier and
> > > configure it to look at all devices (not just removable),
> > > then find the ROOT3 partition, and then click on the "little belt"
> > > icon to the right of the ROOT3, the Device Notifier does mount
> > > the filesystem read-only. Because the filestem is mounted
> > > read-only, I know the Device Notifier (or the tools it calls)
> > > is reading /etc/fstab. But I also know that "nouser" is
> > > apparently being ignored.
> > >
> > > I filed a bug report again the KDE Device Notifier, but they closed
> > > it saying the device notifier calls udisk with calls polkit when
> > > dealing with mounts, so the problem was either a bug or a
> > > misconfiguration of polkit or udisk.
> > >
> >
> > use "udiskctl info -b /dev/sdXN" to check whether partition is
> > considered system or not:
> >
> > bor@opensuse:~> udisksctl info -b /dev/sda1
> > /org/freedesktop/UDisks2/block_devices/sda1:
> > org.freedesktop.UDisks2.Block:
> > Configuration: [('fstab', {'fsname': <b'/dev/sda1'>,
> > 'dir': <b'/boot'>, 'type': <b'ext2'>, 'opts': <b'defaults'>, 'freq': <1>,
> > 'passno': <2>})]
> > ...
> > HintSystem: true
> >
> > System devices require authentication for
> > org.freedesktop.udisks2.filesystem-mount-system action; other devices -
> > for org.freedesktop.udisks2.filesystem-mount. Check whether polkit
> > grants you it:
> >
> > bor@opensuse:~> pkcheck -a
> > org.freedesktop.udisks2.filesystem-mount-system -p $$
> > polkit\56retains_authorization_after_challenge=1
> > Authorization requires authentication and -u wasn't passed.
> >
> > So here poilkit will require explicit authentication for system
> > devices. As opposed to
> >
> > bor@opensuse:~> pkcheck -a org.freedesktop.udisks2.filesystem-mount -p $$
> > bor@opensuse:~/src/udisks> echo $?
> > 0
> >
> > Finally try explicitly mount from command line
> >
> > udisksctl mount -b /dev/sdXN
> >
> > Note that it also depends on whether you have udisks or udisks2 and
> > polkit or polkit2 ... but you got an idea?
> >
> > > I don't want to write a needless bug report if in fact
> > > this is behavior is not a bug. Could someone please
> > > let me know if this is expected behavior ("ro" is used,
> > > but "nouser" seems to be ignored)?
> > >
> > > Yesterday I posted a similar message to the polkit-devel
> > > mailing list, but I haven't heard anything from anyone
> > > there.
> > >
> > > Thanks.
> > >
> > > Paul.
> > >
> > > _______________________________________________
> > > devkit-devel mailing list
> > > devkit-devel@lists.freedesktop.org
> > > http://lists.freedesktop.org/mailman/listinfo/devkit-devel
> >
> >
_______________________________________________
devkit-devel mailing list
devkit-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/devkit-devel
