Sample Header Ad - 728x90

Allow udisksctl loop-setup without authentication for specific users

2 votes
1 answer
1195 views
I have some tests that verify the behavior of a program under conditions where it runs out of disk space. Previously I've used dd to create a small-ish file then mkfs to make a filesystem on it, then used sudo losetup to mount it as a loopback device, then run my test (note, /dev/full is not appropriate here: the test makes lots of files in a directory and it needs to start with space, then run out). But now I'm moving into a CI/CD environment where I don't have any sudo access for the account that will be running the tests so I need an alternative. I discovered udisksctl with loop-setup which works great on my system, but when I run it on the CI/CD systems I still get authorization errors: reading more closely it requires the user to be logged in, so a remote service doesn't appear sufficient. While I can't get full sudo access I could probably install a polkit exception to allow this account to manage loopback devices. I see /usr/share/polkit-1/actions/org.freedesktop.UDisks2.policy with various sections on managing loopback and I've read a number of SO questions that just say edit this file and allow any, which is probably not great. I've not been able to suss out exactly what to do here, is there some way to add a new file into /etc/polkit-1/localuthority somewhere for example that will allow me to specify that a specific user can manage loopback devices without sudo, without a login session (coming in over SSH, for example, or, in this case, invoked from a systemd service with a User= setting)? Or is this method of testing this situation just too complicated and there's something else people would recommend that would be simpler?
Asked by MadScientist (3218 rep)
Jun 17, 2022, 10:17 PM
Last activity: Mar 12, 2023, 09:07 AM