Re: Request peer review; Ubuntu 8.10 Secure Autorun for removable media
On Thursday 08 January 2009 13:03:10 Jeff Gipson wrote:
| Greetings The Austin (TX) Linux and General Discussion;
|
| I finally got sick of the warning dialog box that Ubuntu (Nautilus)
| displays when you insert removable media with autorun.sh in the root
| folder. I just wanted autorun.sh to run. There were some hacks about
| this on the web, but all with stern warnings about security and it being
| a lousy idea to autorun anything. I think it's only a lousy idea to
| autorun untrusted apps, so I created a script that integrates seahorse
| with autorun. The script is below the use cases, and I appreciate
| feedback (I'm a script hacker, not a script artist).
|
| Use case #1:
| User inserts media with no .autorun autorun autorun.sh or autorun.bin
| in root folder.
| Result: Nothing happens
|
| Use case #2:
| User inserts media with .autorun autorun autorun.sh or autorun.bin in
| root folder. No *.sig file exists
| Result: Nothing happens
|
| Use case #3:
| User inserts media with .autorun autorun autorun.sh or autorun.bin in
| root folder. An *.sig file exists, but does not verify.
| Result: Nothing happens
|
| Use case #4:
| User inserts media with .autorun autorun autorun.sh or autorun.bin in
| root folder. An *.sig file exists, verification succeeds.
| Result: the autorun script executes.
Turns out that the script which runs when media is inserted to verify autorun.sig may also be launched by incron. incron takes folder-watching to the kernel level so the auto-run capability no longer requires Nautilus.
incron also gives the equivalent functionality as OS X 'folder actions.' Folders and files can be watched using an incrontab which launches my scripts based on configurable events. E.G. Hamster-Applet (used for time tracking) creates reasonable reports, but doesn't allow me to configure it to put reports in my ~/public_html folder. All reports go straight to $HOME. An incron script can watch $HOME (using the inotify kernel feature) and move files whose names match a regexp from $HOME to ~/public_html, as they are created. In my case, the script also sends an email notification that my hours have been posted.
--
---------------------------
Jeffrey Gipson
Process Networks Plus, Inc.
---------------------------
_______________________________________________ ALG Mailing List http://austinlug.org/cgi-bin/mailman/listinfo/alg
RSS Feed