From ee606b1ccfe210cd0eb50852a00414d8c9f7fa2af3543970d3a8d97c725f0f84 Mon Sep 17 00:00:00 2001 From: Andreas Jaeger Date: Wed, 23 Jan 2019 07:10:41 +0000 Subject: [PATCH] Accepting request 664199 from home:sbrabec New package. OBS-URL: https://build.opensuse.org/request/show/664199 OBS-URL: https://build.opensuse.org/package/show/Base:System/filesystem-media?expand=0&rev=1 --- .gitattributes | 23 ++++++++ .gitignore | 1 + filesystem-media.README | 64 ++++++++++++++++++++++ filesystem-media.changes | 11 ++++ filesystem-media.init | 8 +++ filesystem-media.rpmlintrc | 4 ++ filesystem-media.spec | 106 +++++++++++++++++++++++++++++++++++++ 7 files changed, 217 insertions(+) create mode 100644 .gitattributes create mode 100644 .gitignore create mode 100644 filesystem-media.README create mode 100644 filesystem-media.changes create mode 100644 filesystem-media.init create mode 100644 filesystem-media.rpmlintrc create mode 100644 filesystem-media.spec diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..9b03811 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,23 @@ +## Default LFS +*.7z filter=lfs diff=lfs merge=lfs -text +*.bsp filter=lfs diff=lfs merge=lfs -text +*.bz2 filter=lfs diff=lfs merge=lfs -text +*.gem filter=lfs diff=lfs merge=lfs -text +*.gz filter=lfs diff=lfs merge=lfs -text +*.jar filter=lfs diff=lfs merge=lfs -text +*.lz filter=lfs diff=lfs merge=lfs -text +*.lzma filter=lfs diff=lfs merge=lfs -text +*.obscpio filter=lfs diff=lfs merge=lfs -text +*.oxt filter=lfs diff=lfs merge=lfs -text +*.pdf filter=lfs diff=lfs merge=lfs -text +*.png filter=lfs diff=lfs merge=lfs -text +*.rpm filter=lfs diff=lfs merge=lfs -text +*.tbz filter=lfs diff=lfs merge=lfs -text +*.tbz2 filter=lfs diff=lfs merge=lfs -text +*.tgz filter=lfs diff=lfs merge=lfs -text +*.ttf filter=lfs diff=lfs merge=lfs -text +*.txz filter=lfs diff=lfs merge=lfs -text +*.whl filter=lfs diff=lfs merge=lfs -text +*.xz filter=lfs diff=lfs merge=lfs -text +*.zip filter=lfs diff=lfs merge=lfs -text +*.zst filter=lfs diff=lfs merge=lfs -text diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..57affb6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.osc diff --git a/filesystem-media.README b/filesystem-media.README new file mode 100644 index 0000000..43d46cd --- /dev/null +++ b/filesystem-media.README @@ -0,0 +1,64 @@ +What filesystem-media does? + +It brings /media directory back to you! + + +Why you need filesystem-media? + +Filesystem Hierarchy Standard defines /media as a directory for removable +media. After introduction of udisks, this directory was abandoned in +favor of separated user specific directories. It is more secure, but path +/run/media/{user} is uncomfortable for console use. + +filesystem-media brings /media back as a polyinstantiated directory. It +means that its contents is a private and user specific bind mount to a +particular /run/media/{user}. + +It uses pam_namespace PAM module to provide proper initialization. + + +How filesystem-media works? + +Your /run/media/{user} directory is made accessible in your /media +directory as well. But it is not a standard symlink or bind mount. It is +a private bind mount! Your contents of /media directory is not visible by +other users. They see their own /media directory. + +To get it working, you need to re-login after the installation. + + +Side effects of filesystem-media + +1. With filesystem-media, medium is mounted twice. It causes problems + with a (not recommended) way to unmount devices mounted by udisks: + + umount /run/media/{user}/{medium} + + udisks fails to delete no more used mountpoint. You need to unmount + the volume from /media first. Use the recommended way, and no problem + occurs: + + udisksctl unmount -b {device} + +2. Directory permission required by udisks are incompatible with + permissions required by pam_namespace. As the current pam_namespace + does not support per-mount parent_mode or parent_create, + filesystem-media needs to set ignore_instance_parent_mode globally. + Somebody could considered it as a security risk. + + +To do + +Integration of polyinstantiated /media directly to udisks would be better +than filesystem-media. + + +Author + +filesystem-media was written by Stanislav Brabec + + +License + +filesystem-media a public domain software licensed under the Creative +Commons Zero v1.0 Universal. diff --git a/filesystem-media.changes b/filesystem-media.changes new file mode 100644 index 0000000..202dd18 --- /dev/null +++ b/filesystem-media.changes @@ -0,0 +1,11 @@ +------------------------------------------------------------------- +Wed Jan 9 23:35:42 CET 2019 - sbrabec@suse.com + +- Update documentation. +- Set license to the permissive CC0-1.0. + +------------------------------------------------------------------- +Fri Jul 13 19:01:29 CEST 2018 - sbrabec@suse.com + +- New package, version 0.1. + diff --git a/filesystem-media.init b/filesystem-media.init new file mode 100644 index 0000000..66ccf00 --- /dev/null +++ b/filesystem-media.init @@ -0,0 +1,8 @@ +#!/bin/sh + +if [ "$3" = 1 ]; then + chmod 755 /run/media + chmod 750 "$2" + setfacl -m "u:$4:rx" -m "g::-" "$2" + mount --make-rshared /media +fi diff --git a/filesystem-media.rpmlintrc b/filesystem-media.rpmlintrc new file mode 100644 index 0000000..58adcb1 --- /dev/null +++ b/filesystem-media.rpmlintrc @@ -0,0 +1,4 @@ +# rpmlint does not understand multiline quoted texts. +addFilter("macro-in-comment %{_sysconfdir}") +# This is the purpose of this package. +addFilter("standard-dir-owned-by-package /media") diff --git a/filesystem-media.spec b/filesystem-media.spec new file mode 100644 index 0000000..8e04cd7 --- /dev/null +++ b/filesystem-media.spec @@ -0,0 +1,106 @@ +# +# spec file for package filesystem-media +# +# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany. +# +# All modifications and additions to the file contributed by third parties +# remain the property of their copyright owners, unless otherwise agreed +# upon. The license for this file, and modifications and additions to the +# file, is the same license as for the pristine package itself (unless the +# license for the pristine package is not an Open Source License, in which +# case the license is the MIT License). An "Open Source License" is a +# license that conforms to the Open Source Definition (Version 1.9) +# published by the Open Source Initiative. + +# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# + + +Name: filesystem-media +Version: 0.1 +Release: 0 +Summary: Polyinstantiated /media Directory +License: CC0-1.0 +Group: System/Fhs +Source1: %{name}.README +Source2: %{name}.init +Source3: %{name}.rpmlintrc +Requires: acl +Requires(post): pam +#Supplements: udisks2 +BuildArch: noarch + +%description +Filesystem Hierarchy Standard defines /media as a directory for removable +media. This package provides udisks compatible /media. + +%prep +%setup -q -c -T +cp %{SOURCE1} README +cp %{SOURCE2} . + +%build + +%install +mkdir %{buildroot}/media +mkdir -p %{buildroot}%{_sysconfdir}/security/namespace.d +install %{name}.init %{buildroot}%{_sysconfdir}/security/namespace.d/ + +%triggerin -- pam xdm gdm util-linux lxdm sddm +RC=0 +# Activate pam_namespace in PAM configuration. +for PAM_FILE in xdm xdm-np gdm gdm-autologin lightdm-greeter lxdm sddm sddm-autologin login ; do + if ! test -f %{_sysconfdir}/pam.d/$PAM_FILE ; then + continue + fi + CMNT= + if grep -q '^[^#]*pam_namespace.so' %{_sysconfdir}/pam.d/$PAM_FILE ; then + if ! grep '^[^#]*pam_namespace.so' %{_sysconfdir}/pam.d/$PAM_FILE | grep -q ignore_instance_parent_mode ; then + RC=1 + echo >&2 "filesystem-media needs to install pam_namespace.so module with option ignore_instance_parent_mode. +But file %{_sysconfdir}/pam.d/$PAM_FILE already contains pam_namespace.so without this argument. +Please fix and uncomment line inside filesystem-media comments!" + CMNT="#" + fi + fi + sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/pam.d/$PAM_FILE + sed -i '$a\ +#BEGIN filesystem-media\ +'"${CMNT}"'session required pam_namespace.so ignore_instance_parent_mode\ +#END filesystem-media' %{_sysconfdir}/pam.d/$PAM_FILE +done +exit $RC + +%post +# Configure pam_namespace to handle /media. +sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/security/namespace.conf +sed -i '$a\ +#BEGIN filesystem-media\ +/media /run/media/ context:iscript=%{name}.init\ +#END filesystem-media' %{_sysconfdir}/security/namespace.conf + +%preun +if test $1 -eq 0 ; then + umount /media/* >/dev/null 2>/dev/null || : + umount /media >/dev/null 2>/dev/null || : +fi + +%postun +if test $1 -eq 0 ; then + sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/security/namespace.conf + for PAM_FILE in xdm gdm gdm-autologin login ; do + if ! test -f %{_sysconfdir}/pam.d/$PAM_FILE ; then + continue + fi + sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/pam.d/$PAM_FILE + done +fi + +%files +%doc README +/media +%{_sysconfdir}/security/namespace.d/%{name}.init +# FIXME: should be owned by pam +%dir %{_sysconfdir}/security/namespace.d + +%changelog