How do I whitelist drives / partitions that can be mounted to only those that have entries in /etc/fstab?

Question

On my Ubuntu system, I noticed that some file managers, when open, they can mount any drive that was connected via one of my USB ports (as non-root). In the attempt of preventing this from happening I configured my /etc/fstab like so:

# <file system> <mount point>   <type>  <options>       <dump>  <pass>
/dev/mapper/vgubuntu-root /               ext4    errors=remount-ro 0       1
# /boot was on /dev/nvme0n1p3 during installation
UUID=485794d0-6773-4136-9df9-c8f97fc3c3bc /boot           ext4    defaults        0       2
# /boot/efi was on /dev/nvme0n1p2 during installation
UUID=5E62-20EC  /boot/efi       vfat    umask=0077      0       1
/dev/mapper/vgubuntu-swap_1 none            swap    sw              0       0
#/media/j/sandisk-32GB is my primary USB drive for backups
PARTUUID=d199a40a-b5cc-724b-b70b-1b90e4274ea9 /media/user_xyz/sandisk-32GB ext4 defaults,nofail 0 3

1. How do I prevent automounting or mounting by other than root users of the drives / partition that are not specified in my /etc/fstab?

2. Is it possible to go even further and restrict root from mounting drives other than those whitelisted? E.g., root tries to do mount PARTUUID=this-partition-is-not-whitelisted /media/user_xyz/not-whitelisted and fails, unless they change the configuration that I am trying to set up.

P.S. The particular PARTUUID is just used to convey the idea where I am getting at - I am aware that it is not of a proper format and that root would fail in mounting it because of it. I am on Ubuntu 22.04 LTS.

Answer 1

Mounting/automounting by file managers is indeed done via udisks however, it all goes through an authorization mechanism called polkit which defines actions and rules (who can do what...). One can override the default settings via configuration files called rules.
In this particular case the action is called

org.freedesktop.udisks2.filesystem-mount

and you can inspect the default settings for this action via

pkaction --verbose --action-id org.freedesktop.udisks2.filesystem-mount

which returns something like this:

org.freedesktop.udisks2.filesystem-mount:
  description:       Mount a filesystem
  message:           Authentication is required to mount the filesystem
  vendor:            The Udisks Project
  vendor_url:        https://github.com/storaged-project/udisks
  icon:              drive-removable-media
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   yes

As you can see on the last line, the implicit permission for the active user to mount a filesystem is set to yes. You can override that by writing a new rule. This will not have any effect on the stuff listed in your /etc/fstab. Create a file

/etc/polkit-1/rules.d/90-disable-automount.rules

with the following content:

polkit.addRule(function(action, subject) {
               if (action.id == "org.freedesktop.udisks2.filesystem-mount" ) {
                   return polkit.Result.AUTH_ADMIN;
               }
           });

When you restart the system no user should be able to mount/automount drives unless they have admin rights: they will be prompted for the admin password. If you want to disable that prompt too, replace AUTH_ADMIN with NO.

Answer 2

The solution to question 1) is found here: https://askubuntu.com/questions/1062719/how-do-i-disable-the-auto-mounting-of-internal-drives-in-ubuntu-or-kubuntu-18-04

Basically, turn off udisks2.

systemctl stop udisks2.service

and then test, and do it permanently:

systemctl mask udisks2

This will prevent "normal" users from mounting drives automatically... You should also make sure they are not in the adm or sudo group, as then they could still mount drives.

As Marcus Müller noted in the comments, the solution to 2) would be non-trivial, I think. I can not think of a good answer right off (e.g. if I am root, how do I prevent myself from mounting any drive?). root has to be able to mount drives, it is how the kernel boots, and loads ram disks and such.

Further, as Guntram Blohm noted in the comments, adding:

systemctl mask udisks2

will prevent it from being pulled back into the system in the future, which is a "good thing".

Answer 3

connected via one of my USB ports...

so have the mount entry in your /etc/fstab if you desire, but to deal with disks hotplugged via usb you can use usbguard.

I do not know if it is available for Ubuntu like it is for Redhat, but it is a simple matter of installing, configuring the /etc/usbguard/usbguard-daemon.conf to your liking but the defaults will probably suffice. Then before starting the usbguard service, you must create the /etc/usbguard/rules.conf file otherwise you won't have anything whitelisted to work on the usb ports including your keyboard and mouse and you will be yanking the power cord to reboot and then booting to single user mode to correct,

when you do usbguard generate-policy > /etc/usbguard/rules.conf before doing service usbguard start that will automatically capture existing usb devices and you can recognize those in the rules.conf file, one of which will be your usb connected disk devices which will be identified specifically and explicitly via id, serial, etc. And this will manage what external usb disks will or will not work on the system, you'll be managing it at the usb connection level before udisks sees and mounts them.

for some usbguard detailed info see : usbguard rules allow any keyboard and mouse