edubuntu-bugs team mailing list archive

[Kovid Goyal <885027@xxxxxxxxxxxxxxxxxx>]

As I have already  said, in a previous response, I would be delighted if
someone developed a zero config library that worked across linux distributions
and BSDs to mount USB devices. What's needed is that it allow:

1) The mounting of any USB block device identified by device node 
   to a mountpoint under /media 

2) ejecting of any USB block device and the removal of the corresponding
mountpoint under /media

3) It needs to be embeddable in a self contained distribution like calibre. In
particular this means it must not require the application developer to tweak
it, as such tweaking introduces the possibility of security holes.

However, let me emphasize that these functions are already performed adequately
in modern linux distributions by udisks. An implementation of such a library
in python has been present in calibre in udisks.py for years. This reduces the
incentive of people to work on a solution approporiate to older distributions.
That is regrettable, but unavoidable. Personally, I doubt any such library
will ever be developed. Given the difficulties of dealing with paths securely,
the easiest route to developing it, via calls to mount and eject is closed.
Which means you would essentially have to re-implement mount and eject with
additional logic to allow unprivileged users access to certain classes of
device. That is a huge task.

At this point, people on older distributions will just have to manage their
devices manually. I have taken my best shot at it, and failed. Someone else is
more than welcome to pick up the gauntlet. A library like this has to be self
contained, so development of it should not be part of a larger project like
calibre.

-- 
You received this bug notification because you are a member of Edubuntu
Bugsquad, which is subscribed to calibre in Ubuntu.
https://bugs.launchpad.net/bugs/885027

Title:
  SUID Mount Helper has 5 Major Vulnerabilities

To manage notifications about this bug go to:
https://bugs.launchpad.net/calibre/+bug/885027/+subscriptions