Accepting request 664199 from home:sbrabec
New package. OBS-URL: https://build.opensuse.org/request/show/664199 OBS-URL: https://build.opensuse.org/package/show/Base:System/filesystem-media?expand=0&rev=1
This commit is contained in:
Andreas Jaeger
Git OBS Bridge
commit
ee606b1ccf
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
||||
## Default LFS
|
||||
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||
*.png filter=lfs diff=lfs merge=lfs -text
|
||||
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||
*.zst filter=lfs diff=lfs merge=lfs -text
|
||||
1
.gitignore
vendored
Normal file
1
.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
||||
.osc
|
||||
64
filesystem-media.README
Normal file
64
filesystem-media.README
Normal file
@ -0,0 +1,64 @@
|
||||
What filesystem-media does?
|
||||
|
||||
It brings /media directory back to you!
|
||||
|
||||
|
||||
Why you need filesystem-media?
|
||||
|
||||
Filesystem Hierarchy Standard defines /media as a directory for removable
|
||||
media. After introduction of udisks, this directory was abandoned in
|
||||
favor of separated user specific directories. It is more secure, but path
|
||||
/run/media/{user} is uncomfortable for console use.
|
||||
|
||||
filesystem-media brings /media back as a polyinstantiated directory. It
|
||||
means that its contents is a private and user specific bind mount to a
|
||||
particular /run/media/{user}.
|
||||
|
||||
It uses pam_namespace PAM module to provide proper initialization.
|
||||
|
||||
|
||||
How filesystem-media works?
|
||||
|
||||
Your /run/media/{user} directory is made accessible in your /media
|
||||
directory as well. But it is not a standard symlink or bind mount. It is
|
||||
a private bind mount! Your contents of /media directory is not visible by
|
||||
other users. They see their own /media directory.
|
||||
|
||||
To get it working, you need to re-login after the installation.
|
||||
|
||||
|
||||
Side effects of filesystem-media
|
||||
|
||||
1. With filesystem-media, medium is mounted twice. It causes problems
|
||||
with a (not recommended) way to unmount devices mounted by udisks:
|
||||
|
||||
umount /run/media/{user}/{medium}
|
||||
|
||||
udisks fails to delete no more used mountpoint. You need to unmount
|
||||
the volume from /media first. Use the recommended way, and no problem
|
||||
occurs:
|
||||
|
||||
udisksctl unmount -b {device}
|
||||
|
||||
2. Directory permission required by udisks are incompatible with
|
||||
permissions required by pam_namespace. As the current pam_namespace
|
||||
does not support per-mount parent_mode or parent_create,
|
||||
filesystem-media needs to set ignore_instance_parent_mode globally.
|
||||
Somebody could considered it as a security risk.
|
||||
|
||||
|
||||
To do
|
||||
|
||||
Integration of polyinstantiated /media directly to udisks would be better
|
||||
than filesystem-media.
|
||||
|
||||
|
||||
Author
|
||||
|
||||
filesystem-media was written by Stanislav Brabec <sbrabec@suse.cz>
|
||||
|
||||
|
||||
License
|
||||
|
||||
filesystem-media a public domain software licensed under the Creative
|
||||
Commons Zero v1.0 Universal.
|
||||
11
filesystem-media.changes
Normal file
11
filesystem-media.changes
Normal file
@ -0,0 +1,11 @@
|
||||
-------------------------------------------------------------------
|
||||
Wed Jan 9 23:35:42 CET 2019 - sbrabec@suse.com
|
||||
|
||||
- Update documentation.
|
||||
- Set license to the permissive CC0-1.0.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Jul 13 19:01:29 CEST 2018 - sbrabec@suse.com
|
||||
|
||||
- New package, version 0.1.
|
||||
|
||||
8
filesystem-media.init
Normal file
8
filesystem-media.init
Normal file
@ -0,0 +1,8 @@
|
||||
#!/bin/sh
|
||||
|
||||
if [ "$3" = 1 ]; then
|
||||
chmod 755 /run/media
|
||||
chmod 750 "$2"
|
||||
setfacl -m "u:$4:rx" -m "g::-" "$2"
|
||||
mount --make-rshared /media
|
||||
fi
|
||||
4
filesystem-media.rpmlintrc
Normal file
4
filesystem-media.rpmlintrc
Normal file
@ -0,0 +1,4 @@
|
||||
# rpmlint does not understand multiline quoted texts.
|
||||
addFilter("macro-in-comment %{_sysconfdir}")
|
||||
# This is the purpose of this package.
|
||||
addFilter("standard-dir-owned-by-package /media")
|
||||
106
filesystem-media.spec
Normal file
106
filesystem-media.spec
Normal file
@ -0,0 +1,106 @@
|
||||
#
|
||||
# spec file for package filesystem-media
|
||||
#
|
||||
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
# upon. The license for this file, and modifications and additions to the
|
||||
# file, is the same license as for the pristine package itself (unless the
|
||||
# license for the pristine package is not an Open Source License, in which
|
||||
# case the license is the MIT License). An "Open Source License" is a
|
||||
# license that conforms to the Open Source Definition (Version 1.9)
|
||||
# published by the Open Source Initiative.
|
||||
|
||||
# Please submit bugfixes or comments via http://bugs.opensuse.org/
|
||||
#
|
||||
|
||||
|
||||
Name: filesystem-media
|
||||
Version: 0.1
|
||||
Release: 0
|
||||
Summary: Polyinstantiated /media Directory
|
||||
License: CC0-1.0
|
||||
Group: System/Fhs
|
||||
Source1: %{name}.README
|
||||
Source2: %{name}.init
|
||||
Source3: %{name}.rpmlintrc
|
||||
Requires: acl
|
||||
Requires(post): pam
|
||||
#Supplements: udisks2
|
||||
BuildArch: noarch
|
||||
|
||||
%description
|
||||
Filesystem Hierarchy Standard defines /media as a directory for removable
|
||||
media. This package provides udisks compatible /media.
|
||||
|
||||
%prep
|
||||
%setup -q -c -T
|
||||
cp %{SOURCE1} README
|
||||
cp %{SOURCE2} .
|
||||
|
||||
%build
|
||||
|
||||
%install
|
||||
mkdir %{buildroot}/media
|
||||
mkdir -p %{buildroot}%{_sysconfdir}/security/namespace.d
|
||||
install %{name}.init %{buildroot}%{_sysconfdir}/security/namespace.d/
|
||||
|
||||
%triggerin -- pam xdm gdm util-linux lxdm sddm
|
||||
RC=0
|
||||
# Activate pam_namespace in PAM configuration.
|
||||
for PAM_FILE in xdm xdm-np gdm gdm-autologin lightdm-greeter lxdm sddm sddm-autologin login ; do
|
||||
if ! test -f %{_sysconfdir}/pam.d/$PAM_FILE ; then
|
||||
continue
|
||||
fi
|
||||
CMNT=
|
||||
if grep -q '^[^#]*pam_namespace.so' %{_sysconfdir}/pam.d/$PAM_FILE ; then
|
||||
if ! grep '^[^#]*pam_namespace.so' %{_sysconfdir}/pam.d/$PAM_FILE | grep -q ignore_instance_parent_mode ; then
|
||||
RC=1
|
||||
echo >&2 "filesystem-media needs to install pam_namespace.so module with option ignore_instance_parent_mode.
|
||||
But file %{_sysconfdir}/pam.d/$PAM_FILE already contains pam_namespace.so without this argument.
|
||||
Please fix and uncomment line inside filesystem-media comments!"
|
||||
CMNT="#"
|
||||
fi
|
||||
fi
|
||||
sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/pam.d/$PAM_FILE
|
||||
sed -i '$a\
|
||||
#BEGIN filesystem-media\
|
||||
'"${CMNT}"'session required pam_namespace.so ignore_instance_parent_mode\
|
||||
#END filesystem-media' %{_sysconfdir}/pam.d/$PAM_FILE
|
||||
done
|
||||
exit $RC
|
||||
|
||||
%post
|
||||
# Configure pam_namespace to handle /media.
|
||||
sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/security/namespace.conf
|
||||
sed -i '$a\
|
||||
#BEGIN filesystem-media\
|
||||
/media /run/media/ context:iscript=%{name}.init\
|
||||
#END filesystem-media' %{_sysconfdir}/security/namespace.conf
|
||||
|
||||
%preun
|
||||
if test $1 -eq 0 ; then
|
||||
umount /media/* >/dev/null 2>/dev/null || :
|
||||
umount /media >/dev/null 2>/dev/null || :
|
||||
fi
|
||||
|
||||
%postun
|
||||
if test $1 -eq 0 ; then
|
||||
sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/security/namespace.conf
|
||||
for PAM_FILE in xdm gdm gdm-autologin login ; do
|
||||
if ! test -f %{_sysconfdir}/pam.d/$PAM_FILE ; then
|
||||
continue
|
||||
fi
|
||||
sed -i '/^#BEGIN filesystem-media/,/^#END filesystem-media/d' %{_sysconfdir}/pam.d/$PAM_FILE
|
||||
done
|
||||
fi
|
||||
|
||||
%files
|
||||
%doc README
|
||||
/media
|
||||
%{_sysconfdir}/security/namespace.d/%{name}.init
|
||||
# FIXME: should be owned by pam
|
||||
%dir %{_sysconfdir}/security/namespace.d
|
||||
|
||||
%changelog
|
||||
Loading…
x
Reference in New Issue
Block a user