138 lines
5 KiB
Diff
138 lines
5 KiB
Diff
--- util-linux-ng-2.13-rc3/mount/umount.c.xxx 2007-05-30 10:18:12.000000000 +0200
|
|
+++ util-linux-ng-2.13-rc3/mount/umount.c 2007-08-13 12:02:07.000000000 +0200
|
|
@@ -434,7 +434,7 @@
|
|
umount_file (char *arg) {
|
|
struct mntentchn *mc, *fs;
|
|
const char *file, *options;
|
|
- int fstab_has_user, fstab_has_users, fstab_has_owner, fstab_has_group;
|
|
+ int fstab_has_user, fstab_has_users, fstab_has_owner, fstab_has_group, fstab_has_pamconsole;
|
|
int ok;
|
|
|
|
if (!*arg) { /* "" would be expanded to `pwd` */
|
|
@@ -521,13 +521,16 @@
|
|
fstab_has_users = contains(options, "users");
|
|
fstab_has_owner = contains(options, "owner");
|
|
fstab_has_group = contains(options, "group");
|
|
+ fstab_has_pamconsole = contains(options, "pamconsole");
|
|
ok = 0;
|
|
|
|
if (fstab_has_users)
|
|
ok = 1;
|
|
|
|
if (!ok && (fstab_has_user || fstab_has_owner ||
|
|
- fstab_has_group)) {
|
|
+ fstab_has_group || fstab_has_pamconsole)) {
|
|
+ char pamconsole_file_name[256];
|
|
+ struct stat sb;
|
|
char *user = getusername();
|
|
|
|
options = mc->m.mnt_opts;
|
|
@@ -537,6 +540,14 @@
|
|
|
|
if (user && mtab_user && streq (user, mtab_user))
|
|
ok = 1;
|
|
+
|
|
+ /*pam_console user check*/
|
|
+ if (user && fstab_has_pamconsole) {
|
|
+ snprintf (pamconsole_file_name, sizeof (pamconsole_file_name), "/var/run/console/%s", user);
|
|
+ if (stat (pamconsole_file_name, &sb) == 0) {
|
|
+ ok = 1;
|
|
+ }
|
|
+ }
|
|
}
|
|
if (!ok)
|
|
die (2, _("umount: only %s can unmount %s from %s"),
|
|
--- util-linux-ng-2.13-rc3/mount/fstab.5.xxx 2007-07-03 01:56:04.000000000 +0200
|
|
+++ util-linux-ng-2.13-rc3/mount/fstab.5 2007-08-13 12:02:07.000000000 +0200
|
|
@@ -156,10 +156,10 @@
|
|
.BR nfs (5).
|
|
Common for all types of file system are the options ``noauto''
|
|
(do not mount when "mount -a" is given, e.g., at boot time), ``user''
|
|
-(allow a user to mount), and ``owner''
|
|
-(allow device owner to mount), and ``comment''
|
|
+(allow a user to mount), ``owner''
|
|
+(allow device owner to mount), ``pamconsole'' (allow a user at the console to mount), and ``comment''
|
|
(e.g., for use by fstab-maintaining programs).
|
|
-The ``owner'' and ``comment'' options are Linux-specific.
|
|
+The ``owner'', ``pamconsole'' and ``comment'' options are Linux-specific.
|
|
For more details, see
|
|
.BR mount (8).
|
|
|
|
--- util-linux-ng-2.13-rc3/mount/mount.c.xxx 2007-08-13 12:00:15.000000000 +0200
|
|
+++ util-linux-ng-2.13-rc3/mount/mount.c 2007-08-13 12:05:15.000000000 +0200
|
|
@@ -108,14 +108,15 @@
|
|
#define MS_USER 0x20000000
|
|
#define MS_OWNER 0x10000000
|
|
#define MS_GROUP 0x08000000
|
|
+#define MS_PAMCONSOLE 0x04000000
|
|
#define MS_COMMENT 0x02000000
|
|
#define MS_LOOP 0x00010000
|
|
|
|
/* Options that we keep the mount system call from seeing. */
|
|
-#define MS_NOSYS (MS_NOAUTO|MS_USERS|MS_USER|MS_COMMENT|MS_LOOP)
|
|
+#define MS_NOSYS (MS_NOAUTO|MS_USERS|MS_USER|MS_COMMENT|MS_LOOP|MS_PAMCONSOLE)
|
|
|
|
/* Options that we keep from appearing in the options field in the mtab. */
|
|
-#define MS_NOMTAB (MS_REMOUNT|MS_NOAUTO|MS_USERS|MS_USER)
|
|
+#define MS_NOMTAB (MS_REMOUNT|MS_NOAUTO|MS_USERS|MS_USER|MS_PAMCONSOLE)
|
|
|
|
#define MS_PROPAGATION (MS_SHARED|MS_SLAVE|MS_UNBINDABLE|MS_PRIVATE)
|
|
|
|
@@ -155,6 +156,8 @@
|
|
{ "comment", 0, 0, MS_COMMENT}, /* fstab comment only (kudzu,_netdev)*/
|
|
|
|
/* add new options here */
|
|
+ { "pamconsole", 0, 0, MS_PAMCONSOLE }, /* Allow users at console to mount */
|
|
+ { "nopamconsole", 0, 1, MS_PAMCONSOLE }, /* Console user has no special privs */
|
|
#ifdef MS_NOSUB
|
|
{ "sub", 0, 1, MS_NOSUB }, /* allow submounts */
|
|
{ "nosub", 0, 0, MS_NOSUB }, /* don't allow submounts */
|
|
@@ -379,7 +382,7 @@
|
|
*mask &= ~om->mask;
|
|
else
|
|
*mask |= om->mask;
|
|
- if ((om->mask == MS_USER || om->mask == MS_USERS)
|
|
+ if ((om->mask == MS_USER || om->mask == MS_USERS || om->mask == MS_PAMCONSOLE)
|
|
&& !om->inv)
|
|
*mask |= MS_SECURE;
|
|
if ((om->mask == MS_OWNER || om->mask == MS_GROUP)
|
|
@@ -807,7 +810,29 @@
|
|
}
|
|
}
|
|
|
|
- /* James Kehl <mkehl@gil.com.au> came with a similar patch:
|
|
+ /* Red Hat patch: allow users at console to mount when fstab
|
|
+ contains the console option. This option should not be used
|
|
+ in a high security environment but is useful to give console
|
|
+ users the possibility of using locally attached devices
|
|
+ such as USB keychains and USB harddisks where it is now suitable
|
|
+ to give the console owner write access to the device node */
|
|
+ if (*flags & MS_PAMCONSOLE) {
|
|
+ char *username;
|
|
+ char pamconsole_file_name[256];
|
|
+ struct stat sb;
|
|
+
|
|
+ username = getusername ();
|
|
+
|
|
+ if (username != NULL) {
|
|
+ snprintf (pamconsole_file_name, sizeof (pamconsole_file_name),
|
|
+ "/var/run/console/%s", username);
|
|
+ if (stat (pamconsole_file_name, &sb) == 0) {
|
|
+ *flags |= MS_USER;
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+
|
|
+ /* James Kehl <mkehl@gil.com.au> came with a similar patch:
|
|
allow an arbitrary user to mount when he is the owner of
|
|
the mount-point and has write-access to the device.
|
|
This is even less secure. Let me skip it for the time being;
|
|
@@ -823,7 +848,7 @@
|
|
*user = getusername();
|
|
}
|
|
|
|
- *flags &= ~(MS_OWNER | MS_GROUP);
|
|
+ *flags &= ~(MS_OWNER | MS_GROUP | MS_PAMCONSOLE);
|
|
}
|
|
|
|
static int
|