only mount certain FS as normal user?

[ksas025]

I want to allow normal users to mount some remote filesystems but not be able to mount (or unmount) local filesystems. I understand that if a regular user is in the system group it will have access to un/mount any filesystem in /etc/filesystems that it has write access to. In my opinion this is too much authority.

Is there are way to allow a user to un/mount one or two configured filesystems and deny mount rights to the remainder of the filesystems?

Thanks!

A.

 

[khalidaaa]

One way i can think of for now is to use sudo!

You can write a script (make it owned by the user) and inside that script you can use the mount command called by sudo!

But within the script you can specify the only allowed filesystems to be mounted by that user!?! (even simpler, the filesystems that the user can't mount or unmount)

Regards,
Khalid

 

[ksas025]

Thanks for the response khalidaaa.

That is not a bad idea but I think might be one problem. If the script is owned by the regualr user calling it, what prevents that user from modifing the script to allow for any mounts? Do you agree or am I missing something?

Currently I have never used sudo but I hear good things. Is sudo a package I can install? I am running AIX 4.3.3.

 

[khalidaaa]

Oh yeah you are right! then you have to make another script owned by root which has all the logic and another script owned by the user just calling this script!

You can download sudo from here:

http://aixpdslib.seas.ucla.edu/packages/sudo.html

And that's the manual for the sudoers (the config file for sudo)

http://www.gratisoft.us/sudo/man/sudoers.html

Regards,
Khalid

 

[ngxGraz]

or make the script owned by root, with execute (not read or write) permissions for any user.

 

[RodKnowlton]

ngxGraz, if the user can't read a shell script, they can't execute it.

You could, however make a single script owned by root, chmod it 700, and grant the user sudo privileges to run the script.

Another option, if you already know all possible remote directories, would be to give the user sudo permissions to execute the exact commands to mount them.

- Rod


IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

A Simple Code for Posting on the Web

 

[hfaix]

Another option, if you already know all possible remote directories, would be to give the user sudo permissions to execute the exact commands to mount them.

Yep...this is how I do it.

 

[ksas025]

Thanks for all your responses.

It seems that sudo is the way to go here. I only wish AIX had something similar to Linux in which /etc/fstab specifies what filesystems regular users have un/mount permission on.

Anyways, Thanks again!

Alex