I'll save you the trouble of making a fool of yourself and do it myself in a more Professional manner, better suited for a UNIX
smart aleck":
"an obnoxiously conceited and self-assertive person with pretensions to smartness or cleverness"
And this forum than you would have gotten had you answered quickly.
Well, I entered this thread, and you almost brought me near to a heart attack. I am shipping electrochemical laboratory equipment and the controlling device and data acquisition is done by a PC operated by FreeBSD 12 with the GNOME3 desktop environment. I rely on the functionality of USB removable media plugged-in by end users, because most customers don’t let these systems into their LAN, and without that, the scientists would need to use a ball pen to transcribe megabytes of measurement data from the screen, won’t they?
Wonder why they won't allow those systems onto their LAN and you will allow them to insert their USB stick onto a Company machine? Is your Supervisor aware of this? Because they should be, and if they are and that is permissible? I'm glad it's not my Company.
Allow me to quote the same thing I did above from the FreeBSD Handbook, twice, since it is the Handbook:
Allowing untrusted users to mount arbitrary media, by enabling vfs.usermount as described below, should not be considered safe from a security point of view. Most file systems were not built to safeguard against malicious devices.
I tried it once again - and of course it works. A normal user can plugin a USB drive, GNOME does mount it as the user who is logged-in, and we can get hands on our data. So what you’re talking about? Here comes the evidence photo. A USB pendrive named Daten just plugged-in to the Desktop system, when user rolf was logged-in.
Here come the facts.
Right below that it states:
To make the device mountable as a normal user, one solution is to make all users of the device a member of the
operator group using
pw(8). Next, ensure that
operator is able to read and write the device by adding these lines to /etc/devfs.rules:
[localrules=5]
add path 'da*' mode 0660 group operator
From the same
/etc/devfs.rules file listed
on my Tutorial:
"Copy this text into leafpad:
[devfsrules_common=7]
add path 'da*' mode 0666 group operator
And save it as
/etc/devfs.rules
That's in the /etc directory, the filename is devfs.rules
Now enter the following commands:
echo 'devd_enable="YES"' >> /etc/rc.conf
echo 'devfs_system_ruleset="devfsrules_common"' >> /etc/rc.conf"
I'm already out of compliance in my naming of rules with steps outlined to allow a usr to mount USB drives, and where my Policy begins:
jitte@bakemono:~ $ df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/ada0s1a 447G 120G 291G 29% /
devfs 1.0K 1.0K 0B 100% /dev
linprocfs 4.0K 4.0K 0B 100% /compat/linux/proc
linsysfs 4.0K 4.0K 0B 100% /compat/linux/sys
devfs 1.0K 1.0K 0B 100% /compat/linux/dev
fdescfs 1.0K 1.0K 0B 100% /compat/linux/dev/fd
tmpfs 4.8G 4.0K 4.8G 0% /compat/linux/dev/shm
jitte@bakemono:~ $ groups jitte
jitte wheel operator
jitte@bakemono:~ $ mount -v -t msdosfs /dev/da0s1 /media/da0s1
mount_msdosfs: /dev/da0s1: Operation not permitted
/dev/ada0s1a on / (ufs, local, journaled soft-updates, writes: sync 5733 async 26285, reads: sync 274443 async 36174)
jitte@bakemono:~ $ df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/ada0s1a 447G 120G 291G 29% /
devfs 1.0K 1.0K 0B 100% /dev
linprocfs 4.0K 4.0K 0B 100% /compat/linux/proc
linsysfs 4.0K 4.0K 0B 100% /compat/linux/sys
devfs 1.0K 1.0K 0B 100% /compat/linux/dev
fdescfs 1.0K 1.0K 0B 100% /compat/linux/dev/fd
tmpfs 3.9G 4.0K 3.9G 0% /compat/linux/dev/shm
jitte@bakemono:~ $ su
Password:
root@bakemono:/home/jitte # cd /
root@bakemono:/ # mount -v -t msdosfs /dev/da0s1 /media/da0s1
/dev/da0s1 on /media/da0s1 (msdosfs, local, writes: sync 1 async 0, reads: sync 3667 async 0, fsid c700000032000000)
root@bakemono:/ # df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/ada0s1a 447G 120G 291G 29% /
devfs 1.0K 1.0K 0B 100% /dev
linprocfs 4.0K 4.0K 0B 100% /compat/linux/proc
linsysfs 4.0K 4.0K 0B 100% /compat/linux/sys
devfs 1.0K 1.0K 0B 100% /compat/linux/dev
fdescfs 1.0K 1.0K 0B 100% /compat/linux/dev/fd
tmpfs 3.9G 4.0K 3.9G 0% /compat/linux/dev/shm
/dev/da0s1 115G 98G 16G 86% /media/da0s1
root@bakemono:/ # exit
exit
jitte@bakemono:~ $ umount -v -t msdosfs /dev/da0s1 /media/da0s1
umount: unmount of /media/da0s1 failed: Operation not permitted
umount: unmount of /media/da0s1 failed: Operation not permitted
jitte@bakemono:~ $ su
Password:
root@bakemono:/home/jitte # mount -v -t msdosfs /dev/da0s1 /media/da0s1
mount_msdosfs: /dev/da0s1: Device busy
/dev/da0s1 on /media/da0s1 (msdosfs, local, writes: sync 1 async 1, reads: sync 3667 async 0, fsid c700000032000000)
root@bakemono:/home/jitte # df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/ada0s1a 447G 120G 291G 29% /
devfs 1.0K 1.0K 0B 100% /dev
linprocfs 4.0K 4.0K 0B 100% /compat/linux/proc
linsysfs 4.0K 4.0K 0B 100% /compat/linux/sys
devfs 1.0K 1.0K 0B 100% /compat/linux/dev
fdescfs 1.0K 1.0K 0B 100% /compat/linux/dev/fd
tmpfs 4.0G 4.0K 4.0G 0% /compat/linux/dev/shm
/dev/da0s1 115G 98G 16G 86% /media/da0s1
root@bakemono:/home/jitte # exit
exit
jitte@bakemono:~ $ xfe
Here comes the evidence I can transfer files from that root mounted USB stick from my usr account onto my usr account file manager with my permissions. Do I really need to show two shots to show the file in that Directory afterwards?
Media be mounted only be root? Come on, this is an April fool joke from nerdistan. I do this since the 90th with all my desktop systems, mostly Mac's (some Windows'). Personally, I use FreeBSD not as a desktop but as a server OS, and with that it never made a difference, because I login as root anyway.
Mostly Mac's and Windows. Doesn't use FreeBSD as a desktop and logs in as root to work instead of logging into the usr account and issuing
su to become root.
I won't degrade you further. You've done a fine job of it yourself.
Now if you would like the Psycho Psychologist response, there is only one turn left you in Xanados Speed Chess. Make it a good one and be as brutally honest and verbose as possible, please.
bugs.freebsd.org