Enforcing policies

[David Zeuthen]

On Sat, 2009-06-27 at 15:03 +0000, echo6 wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Perhaps this isn't the place to raise this so forgive me if it is the
> wrong list.
> 
> Whilst deploying Linux on a variety of platforms and distros I have
> always found it frustrating to find a consistent way of enforcing
> policies when handling block devices.
> 
> e.g. Forcing mount -o ro
> 
> Is it appropriate for devkit to handle this ? If not what is the correct
> way to enforce such a policy?

Well, in modern times it usually looks like this. An unprivileged user
clicks an icon or insert media and this happens

   desktop session <-> devkit-disks-daemon <-> mount(8) <-> kernel

with devkit-disks-daemon running mount(8) as the user if the device is
in /etc/fstab. If not, an authorization check with polkit is performed
and if authorized the mount is done after sanitizing mount options
passed by the desktop session.

I think the right way to enforce the behavior you want is to add hooks
to either util-linux-ng or the kernel to modify mount options.

The alternative is modifying all the devkit-disks-daemon users out
there, but there is normally one per desktop and the one in GNOME
doesn't read settings (such as setting ro for every mount) and probably
won't be doing that in the future either (see a previous thread on this
list discussing this).

    David