You are not logged in.
Pages: 1
As an experiment, in order to gain more direct, as-needed, control over whether external drives and partitions are mounted as read only or read write, I have un-installed gvfs and now control mounts directly from the command line.
So far, there does not appear to be any actual problems. But, there is, however, a minor annoyance with Thunar showing double mounts in the side panel for each newly mounted device.
Mounting my Shared partition and Docs drive, then checking, for example:
~$ cat /proc/self/mounts | grep "sd[a-z][0-9]"
/dev/sda3 / ext4 rw,noatime,discard,stripe=32742,data=ordered 0 0
/dev/sda1 /boot/efi vfat rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0
/dev/sda4 /home/stupidme/Shared ext4 ro,relatime,data=ordered 0 0
/dev/sdb1 /home/stupidme/Docs ext4 ro,relatime,stripe=8191,data=ordered 0 0
~$You can see that there are only single entries for each device
I have udisks2 installed, which I need for a number of must have applications, and am using mount and umount to control how devices are mounted. Since I didn't have this problem with gvfs, I do not think the latter is the source of the problem.
So, does anyone have any idea where Thunar is picking up the extra mount?
Irvine
PS
Additionally, Thunar is also showing a possible(?) double entry in the side panel for the File System and Filesystem root partitions and is also displaying the efi partition. None of which it did before I un-installed gvfs.
Last edited by IrvineHimself (2018-06-08 20:35:26)
Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!
Offline
I was looking at the gvfs docs and noticed the GVFS_REMOTE_VOLUME_MONITOR_IGNORE flag, which, from the point of view of gaining direct control of mount operations, amounts to the same thing as un-installing gvfs. So, I re-installed gvfs and added the following to my openbox auto-start file:
export GVFS_REMOTE_VOLUME_MONITOR_IGNORE=0In the sense that gvfs and, indirectly, Thunar have no control of mount operations, this works. Unfortunately, as above, I am still getting double entries in the side panel for the partitions and devices which I mount manually.
So, while this is a better solution than un-installing gvfs, these double side panel entries are annoying
Irvine
Edit:
I thought maybe a screen shot might help explain the problem. You can see the full size image here

edited links to show image of Thunar-Shared
Last edited by IrvineHimself (2018-06-08 10:21:01)
Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!
Offline
So, I have continued with my investigation, and the results are probably best presented as an itemised list:
I discovered that, when launching Thunar from the menu, as oppose to panel, I didn't have problem with it showing double mounts.
Also export GVFS_REMOTE_VOLUME_MONITOR_IGNORE=0 doesn't work when Thunar is launched from menu.
Tested this with a keybind I use to selectively disable the Thunar Firejail symlink. Again, no problem with it showing double mounts.
Ran a number of tests of paths in Terminal.... Definitely something to do with the symlink
Uninstalled gvfs
Tried disabling my Fjsymlinks folder and creating the symlink: sudo ln -s /usr/bin/thunar /usr/local/bin/thunar, I had no problem with the double entry
Re-enabled symlinks and, intending to bisect the profile, I commented out all the options, still had the problem.
Tested with Firejail and Pcmanfm and found a similar problem.
Important: Despite the above, this is not exactly a Firejail problem per se, but a problem with not using gvfs to control mounts. Specifically, if gvfs is installed and GVFS_REMOTE_VOLUME_MONITOR_IGNORE is not set, then there is no problem, regardless of whether Firejail is used or not.
Looking at similar-ish, (but nowhere near identical,) problems on the Xfce Forum
There is a general expectation that gvfs is both: installed and fully enabled
There was a suggestion for a problem to do with the Xfce4-panel that the xfce4-panel.xml was, 'somehow', being read twice?
To sum up: I like Thunar; it works well with the Xfce4-panel which, with it's drop down menus, makes it the perfect tool for the way I like to work. So, since it is an annoyance rather than serious problem, until I find a permanent solution, I will just learn to live with it.
I am going to leave the thread as unsolved, but unless someone has some idea of why gvfs should be so important, I do not think I will be spending much more time on this.
Irvine
Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!
Offline
It figures that as soon as I stopped looking for a solution and started to relax, I would find it.
While, in general, <applications> do not need gvfs, it appears that when running inside a Firejail sandbox, many do. Thunar being one of the less extreme examples. In particular, since I am just switching off for the evening, I found out that both the on-screen keyboard onboard and the solitaire game pack aisleriot just will not work inside a Firejail sandbox without gvfs being installed.
While these are fairly trivial examples, given that I found out as soon as I turned my attention away from the immediate problem with Thunar, I am sure there are many other <applications> that need gvfs in order to work inside Firejail sandboxes.
Thinking about it, since Firejail works by mounting chroots, private versions of /usr/bin/, /usr/lib/, /etc/.... and so on. it actually makes a weird kind of sense.
All the best
Irvine
Last edited by IrvineHimself (2018-06-08 20:42:40)
Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!
Offline
Afterword:
After sleeping on it, I remembered that there is more than one way to skin a cat. So, I asked myself: "What exactly am I trying to achieve?" As a result, I narrowed the focus of the task to:
(1) I don't want a casual user to be able to use the file manager functionality to skirt my access access controls.
(2) Even worse, given that polkit wasn't asking for permission to mount my external drives, udiskctl was creating a large security hole. (As part of my hardening project, I eventually intend to get around to encrypting these drives. But that is for later.)
(3) Finaly, I want the polkit authorisation for my file manager to match the sudo authorisation of the shells I use to control what read/write permissions a device or partition has.
Problem #3, making polkit ask for the root password, was easily solved by copying the example in the Arch wiki
Serendipitously, the solution to problem #1 also solved #2..... I had to do an internet search to compare several examples, but, given polkit's extremely scarey reputation, it was surprisingly easy to come up with:
polkit.addRule(function(action, subject) {
if (action.id == "org.freedesktop.udisks2.filesystem-mount") {
return polkit.Result.AUTH_ADMIN;
}
});So that's it folks, problem solved
Irvine
Et voilà, elle arrive. La pièce, le sous, peut-être qu'il arrive avec vous!
Offline
Pages: 1