Allow udisksctl loop-setup without authentication for specific users
2
votes
1
answer
1195
views
I have some tests that verify the behavior of a program under conditions where it runs out of disk space. Previously I've used
dd
to create a small-ish file then mkfs
to make a filesystem on it, then used sudo losetup
to mount it as a loopback device, then run my test (note, /dev/full
is not appropriate here: the test makes lots of files in a directory and it needs to start with space, then run out).
But now I'm moving into a CI/CD environment where I don't have any sudo
access for the account that will be running the tests so I need an alternative.
I discovered udisksctl
with loop-setup
which works great on my system, but when I run it on the CI/CD systems I still get authorization errors: reading more closely it requires the user to be logged in, so a remote service doesn't appear sufficient.
While I can't get full sudo access I could probably install a polkit exception to allow this account to manage loopback devices. I see /usr/share/polkit-1/actions/org.freedesktop.UDisks2.policy
with various sections on managing loopback and I've read a number of SO questions that just say edit this file and allow any
, which is probably not great.
I've not been able to suss out exactly what to do here, is there some way to add a new file into /etc/polkit-1/localuthority
somewhere for example that will allow me to specify that a specific user can manage loopback devices without sudo
, without a login session (coming in over SSH, for example, or, in this case, invoked from a systemd
service with a User=
setting)?
Or is this method of testing this situation just too complicated and there's something else people would recommend that would be simpler?
Asked by MadScientist
(3218 rep)
Jun 17, 2022, 10:17 PM
Last activity: Mar 12, 2023, 09:07 AM
Last activity: Mar 12, 2023, 09:07 AM