Restricting MTP devices from being mounted by a user/group

Question

I am working on converting an Ubuntu (14.04 LTS) installation into a kiosk-like system with disabled USB storage. However, this does not prevent a user from mounting an MTP device such as an android phone.

This problem is not the same as preventing auto-mounting of MTP devices, which has been solved in other questions on AskUbuntu.

1. I want to permanently disallow MTP and other storage devices from being mounted by a particular user or group. (Maybe by disabling mtpfs/gvfs?)
2. What some other means of connecting writeable storage devices that I should take care of (like UMTS)?

--

edit: I should add that I disabed USB storage by revoking access rights for the group in question by chown'ing /media to admin:myusbaccessgroup. Obviously, the users/groups I want to prevent from using the USB are not in myusbaccessgroup.

--

Update:

A bounty was put for this answer but no successful solution was found. Please see the answers before followed by the chat room discussion.

Giving up, I installed Ubuntu 12.04 instead, since it doesn't have support for MTP out of the box. However, PTP devices still get mounted.

Solution 1

I had the same requirement in my end .

Best way to Block MTP,PTP for android is to disable the service in ubuntu .

Enter this location as root /usr/lib/gvfs

"sudo nautilus" will be easy if you tend to use GUI

"sudo nautilus" and the n navigate to computer/usr/lib/gvfs

There will be list of services Remove the execute permission by right clicking the appropriate service-->properties-->permission-->unckeck "execute" and change the read only access from "read only" to "none"

Blocking MTP and PTP

Remove the execute permission for

gvfsd-mtp

gvfs-mtp-volume-monitor(for safer side)

gvfsd-gphoto2

gvfs-gphoto2-volume-monitor(for safer side)

---

Apple I phone can mount through afp

so kindly Remove the execute permission for gvfsd-afp

gvfs-afc-volume-monitor(for safer side)

some android mobiles can use mass-storage mode to mount there SD card change the folder permission in /media/user to 400

user- the created user in ubuntu.

chmod 400

or remove the mount permission for user..

Solution 2

I couldn't get it to work using user/group permissions neither I know how libmtp mount phones volumes.

This is a solution to check the user group from udev side.

1. Switch to root

   sudo -i
   

2. Create a generic script to check GUI user and if it's in specified group

   nano /lib/udev/check_gui_user_group.sh
   

   Add these line to it:

   #!/bin/bash
   
   export GUI_$(grep -z USER /proc/$(pgrep -nx $1)/environ)
   groups $GUI_USER | grep -qFw "$2"
   

   Add executing permission

   chmod +x /lib/udev/check_gui_user_group.sh
   

3. MTP devices: Let override libmtp rules in /lib/udev/rules.d/ .

   cp /lib/udev/rules.d/69-libmtp.rules /etc/udev/rules.d/69-libmtp.rules
   

   Then open it for editing:

   nano /etc/udev/rules.d/69-libmtp.rules
   

   Add this line just after LABEL="libmtp_usb_rules":

   PROGRAM!="check_gui_user_group.sh gnome-session myusbaccessgroup", GOTO="libmtp_rules_end"
   

   For Ubuntu 14.04 Unity & Gnome, you may use gnome-session. For other desktops, check using pstree -u or ps aux | grep -i session

   The meaning of the rule: Whenever the user of gnome-session is NOT in the myusbaccessgroup group skip all libmtp rules.

4. PTP devices: Add another rules file

   nano /etc/udev/rules.d/99-usb-storage-remove.rules
   

   Add rule

   ACTION=="add", ENV{GPHOTO2_DRIVER}=="PTP", ENV{DRIVER}!="", PROGRAM!="check_gui_user_group.sh gnome-session myusbaccessgroup", RUN+="/bin/sh -c 'echo -n %k >/sys%p/subsystem/drivers/%E{DRIVER}/unbind'"
   

5. Other USB storage devices: Add this rule to the rules file of the previous step.

   ACTION=="add", DRIVER=="usb-storage|uas|ums-*", PROGRAM!="check_gui_user_group.sh gnome-session myusbaccessgroup", RUN+="/bin/sh -c 'echo -n %k >/sys%p/driver/unbind'"
   

   To know from where I get the list of drivers, try this:

   ls /lib/modules/$(uname -r)/kernel/drivers/usb/storage/
   

6. Reload the rules

   udevadm control -R
   

7. Replug your phone.

---

Testing & Troubleshooting:

1. Setup the group, if it's not already done

   addgroup myusbaccessgroup
   

2. Remove user from the group.

   deluser user myusbaccessgroup
   

3. Run udev monitor

   udevadm monitor -u
   

4. Replug that device

5. Check what was run

   udevadm test /sys/device/...
   

6. Add user to the group

   adduser user myusbaccessgroup
   

7. Redo starting from step 3.

Notes:

I used Kubuntu 15.04 (real machine) and Ubuntu 14.04 (fresh install in VirtualBox) for testing.

• I used Wiko Bloom (Android 4.4.2) to test MTP mode which works well in both systems.
• I couldn't test PTP mode because it wasn't auto-mounted, May be I'm missing something here.
• Other external storages: a flash disk & an external hard drive. Test passes for both systems.

References:

• man udev look for PROGRAM uses.
• How to pause VLC playback when the headphones are disconnected? , nice trick by Stunts to import current environment variables.

Comments

[Pilot6]

I wanted to add a bounty too. I could not find a solution myself. I will give an additional bounty, if we get an answer.

[Daniel]

Have you tried changing ownership of the device (like /dev/mtp1 or whatever) to root:root?

[Daniel]

Then they would need sudo access, and you can disable sudo access for that user/group

[Akshay Rao]

@Daniel, root:rooting /dev/ but to no avail. The users/groups I need to disable this for are not in the sudo group.

[Akshay Rao]

@Pilot6, hope this works out!

[Pilot6]

I even removed usb-storage.ko. But on next reboot it got mounted using usbfs driver.

[Akshay Rao]

Perhaps the script you ran to remove usb-storage.ko can be put inside rc.local or some such startup script file? However, did removing usb-storage.ko disable your MTP device from mounting?

[Daniel]

Did you root:root /dev/ recursively?

[Daniel]

If that works I'll put it as an answer

[Akshay Rao]

I already that and it did not work. I don't believe these devices are mounted onto /dev/. I could be wrong.

[Akshay Rao]

@Pilot6, I want to add more bounty now, but can't seem to do it. Do you still wanna put some bounty from your side?

[Pilot6]

We can't add any bounty until you award this one or it expires. Please ping me if the solution is found. I will add my bounty.

[muru]

Is that export GUI_$(... supposed to be export GUI_USER=$(? Also, instead of looping over groups, you could just grep: groups $GUI_USER | grep -qFw "$2"

[user.dz]

@muru, USER= is already in grep -z command, yes that's simpler. thank you

[Pilot6]

I thought abut this. But there MUST be some better solution. And I notice that some phones get mounted when there is nothing in 69-libmtp.rules

[user.dz]

@Pilot6, could you confirm if they are in MTP mode and how they get mounted without dev/libmtp.. link? I know that old device like android 2.x get mounted as usb storage.

[Pilot6]

The brand new android 5.0 device gets mounted without a line in libmtp.rules. Also it does with usb-devices. When I removed usb-devices.ko it still got mounted with usbfs.

[user.dz]

@Pilot6, I couldn't find usb-devices.ko & usbfs,ko in my system neither through packages.ubuntu.com . The only one i could find is usb-storage.ko , I have add another rule for other storage types. Could you please try it.

[Pilot6]

Sry, it is usb-storage.ko. I could not find usbfs either. But it is shown in usb-devices as a driver if any other driver is disabled. I do not use your script, just try to kill it for everyone just to start with.

[Akshay Rao]

@Sneetsher, I will try your solution out tomorrow (can't today) and get back to you. If it works well for the few MTP devices I have, I'll mark this as the answer. Please let me know if you have a better answer using Pilot6's comments about using usb-storage. In the mean time, can you guys think of other ways a device can connect to ubuntu? Like PTP/UMTS etc? It doesn't even have to be a phone per say. I'm trying to disable any external input and outputs using the USB here.

[Pilot6]

it is really weird that such a simple user restriction is so hard to achieve in linux.

[user.dz]

@Pilot6, I agree it shouldn't be hard, I thought about polkit but I have no experience with it.

[Pilot6]

I thought same and I have the same problem. I never dealt with it. I was hoping someone knows how to do it.

[Akshay Rao]

@Sneetsher, unfortunately this didn't work for me :( :( :( I was so hopeful. I was able to open all android phones I connected. Is there anything (any logs etc) you'd want to check to troubleshoot?

[user.dz]

@AkshayRao , updated the answer. You may post output of udevadm test .. to paste.Ubuntu.com

[Akshay Rao]

@Sneetsher, here you go! paste.ubuntu.com/12435931

[user.dz]

@AkshayRao, I have added neew rule for PTP devices. Would you please try it.

[Akshay Rao]

@Sneetsher, still no luck. Both (MTP and PTP) connections are readable and writeable. However the troubleshooting did show a few non-zero return values from the tests. Maybe they would help. paste.ubuntu.com/12446584

[user.dz]

@AkshayRao , could you make another test output for mtp mode.

[Akshay Rao]

@Sneetsher, I was under the impression that this was for MTP mode as well. I'll get back to you in a few.

[Akshay Rao]

@Sneetsher, here you go. By the way, the one I pasted before was MTP (sorry about that). This one contains PTP first and then MTP. Samsung Galaxy S3 paste.ubuntu.com/12448398

[user.dz]

Let us continue this discussion in chat.

[Pilot6]

This did not work. The phone still gets mounted with usbfs.

[user.dz]

:( out of ideas, It hit the wall. BTW, @Pilot6 are using Ubuntu 14.04/Unity?

[Pilot6]

I use default 14.04 LTS with unity. But it does not matter much I guess.

[Jake]

Thank you! Works like a charm on Ubuntu 16.04. Just note that you need to reboot to see the change.

[mxmlnkn]

hardcore approach which only works when having root access, but it works, thank you.