Accepting request 664199 from home:sbrabec

New package.

OBS-URL: https://build.opensuse.org/request/show/664199
OBS-URL: https://build.opensuse.org/package/show/Base:System/filesystem-media?expand=0&rev=1

.gitattributes

@@ -0,0 +1,23 @@
+## Default LFS
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.bsp filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.gem filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.jar filter=lfs diff=lfs merge=lfs -text
+*.lz filter=lfs diff=lfs merge=lfs -text
+*.lzma filter=lfs diff=lfs merge=lfs -text
+*.obscpio filter=lfs diff=lfs merge=lfs -text
+*.oxt filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.rpm filter=lfs diff=lfs merge=lfs -text
+*.tbz filter=lfs diff=lfs merge=lfs -text
+*.tbz2 filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.ttf filter=lfs diff=lfs merge=lfs -text
+*.txz filter=lfs diff=lfs merge=lfs -text
+*.whl filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1 @@
+.osc

filesystem-media.README

@@ -0,0 +1,64 @@
+What filesystem-media does?
+
+It brings /media directory back to you!
+
+
+Why you need filesystem-media?
+
+Filesystem Hierarchy Standard defines /media as a directory for removable
+media. After introduction of udisks, this directory was abandoned in
+favor of separated user specific directories. It is more secure, but path
+/run/media/{user} is uncomfortable for console use.
+
+filesystem-media brings /media back as a polyinstantiated directory. It
+means that its contents is a private and user specific bind mount to a
+particular /run/media/{user}.
+
+It uses pam_namespace PAM module to provide proper initialization.
+
+
+How filesystem-media works?
+
+Your /run/media/{user} directory is made accessible in your /media
+directory as well. But it is not a standard symlink or bind mount. It is
+a private bind mount! Your contents of /media directory is not visible by
+other users. They see their own /media directory.
+
+To get it working, you need to re-login after the installation.
+
+
+Side effects of filesystem-media
+
+1. With filesystem-media, medium is mounted twice. It causes problems
+   with a (not recommended) way to unmount devices mounted by udisks:
+
+   umount /run/media/{user}/{medium}
+
+   udisks fails to delete no more used mountpoint. You need to unmount
+   the volume from /media first. Use the recommended way, and no problem
+   occurs:
+
+   udisksctl unmount -b {device}
+
+2. Directory permission required by udisks are incompatible with
+   permissions required by pam_namespace. As the current pam_namespace
+   does not support per-mount parent_mode or parent_create,
+   filesystem-media needs to set ignore_instance_parent_mode globally.
+   Somebody could considered it as a security risk.
+
+
+To do
+
+Integration of polyinstantiated /media directly to udisks would be better
+than filesystem-media.
+
+
+Author
+
+filesystem-media was written by Stanislav Brabec <sbrabec@suse.cz>
+
+
+License
+
+filesystem-media a public domain software licensed under the Creative
+Commons Zero v1.0 Universal.

filesystem-media.changes

@@ -0,0 +1,11 @@
+-------------------------------------------------------------------
+Wed Jan  9 23:35:42 CET 2019 - sbrabec@suse.com
+
+- Update documentation.
+- Set license to the permissive CC0-1.0.
+
+-------------------------------------------------------------------
+Fri Jul 13 19:01:29 CEST 2018 - sbrabec@suse.com
+
+- New package, version 0.1.
+

filesystem-media.init

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if [ "$3" = 1 ]; then
+	chmod 755 /run/media
+	chmod 750 "$2"
+	setfacl -m "u:$4:rx" -m "g::-" "$2"
+	mount --make-rshared /media
+fi

filesystem-media.rpmlintrc

@@ -0,0 +1,4 @@
+# rpmlint does not understand multiline quoted texts.
+addFilter("macro-in-comment %{_sysconfdir}")
+# This is the purpose of this package.
+addFilter("standard-dir-owned-by-package /media")

filesystem-media.spec

@@ -0,0 +1,106 @@
+#
+# spec file for package filesystem-media
+#
+# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via http://bugs.opensuse.org/
+#
+
+
+Name:           filesystem-media
+Version:        0.1
+Release:        0
+Summary:        Polyinstantiated /media Directory
+License:        CC0-1.0
+Group:          System/Fhs
+Source1:        %{name}.README
+Source2:        %{name}.init
+Source3:        %{name}.rpmlintrc
+Requires:       acl
+Requires(post): pam
+#Supplements:    udisks2
+BuildArch:      noarch
+
+%description
+Filesystem Hierarchy Standard defines /media as a directory for removable
+media. This package provides udisks compatible /media.
+
+%prep
+%setup -q -c -T
+cp %{SOURCE1} README
+cp %{SOURCE2} .
+
+%build
+
+%install
+mkdir %{buildroot}/media
+mkdir -p %{buildroot}%{_sysconfdir}/security/namespace.d
+install %{name}.init %{buildroot}%{_sysconfdir}/security/namespace.d/
+
+%triggerin -- pam xdm gdm util-linux lxdm sddm
+RC=0
+# Activate pam_namespace in PAM configuration.
+for PAM_FILE in xdm xdm-np gdm gdm-autologin lightdm-greeter lxdm sddm sddm-autologin login ; do
+	if ! test -f %{_sysconfdir}/pam.d/$PAM_FILE ; then
+		continue
+	fi
+	CMNT=
+	if grep -q '^[^#]*pam_namespace.so' %{_sysconfdir}/pam.d/$PAM_FILE ; then
+		if ! grep '^[^#]*pam_namespace.so' %{_sysconfdir}/pam.d/$PAM_FILE | grep -q ignore_instance_parent_mode ; then
+			RC=1
+			echo >&2 "filesystem-media needs to install pam_namespace.so module with option ignore_instance_parent_mode.
+But file %{_sysconfdir}/pam.d/$PAM_FILE already contains pam_namespace.so without this argument.
+Please fix and uncomment line inside filesystem-media comments!"
+			CMNT="#"
+		fi
+	fi
+	sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/pam.d/$PAM_FILE
+	sed -i '$a\
+#BEGIN filesystem-media\
+'"${CMNT}"'session  required       pam_namespace.so ignore_instance_parent_mode\
+#END filesystem-media' %{_sysconfdir}/pam.d/$PAM_FILE
+done
+exit $RC
+
+%post
+# Configure pam_namespace to handle /media.
+sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/security/namespace.conf
+sed -i '$a\
+#BEGIN filesystem-media\
+/media   /run/media/           context:iscript=%{name}.init\
+#END filesystem-media' %{_sysconfdir}/security/namespace.conf
+
+%preun
+if test $1 -eq 0 ; then
+	umount /media/* >/dev/null 2>/dev/null || :
+	umount /media >/dev/null 2>/dev/null || :
+fi
+
+%postun
+if test $1 -eq 0 ; then
+	sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/security/namespace.conf
+	for PAM_FILE in xdm gdm gdm-autologin login ; do
+		if ! test -f %{_sysconfdir}/pam.d/$PAM_FILE ; then
+			continue
+		fi
+		sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/pam.d/$PAM_FILE
+	done
+fi
+
+%files
+%doc README
+/media
+%{_sysconfdir}/security/namespace.d/%{name}.init
+# FIXME: should be owned by pam
+%dir %{_sysconfdir}/security/namespace.d
+
+%changelog