Houmeres/Plasma-Addon-Synology-NAS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Add privileged mount helper + polkit policy

Browse Source 
POSIX sh helper (pkexec target) that mounts/unmounts CIFS shares with strict
validation of the unprivileged caller's arguments: mountpoint confined to
$HOME or /run/media/<user>, //host/share source, credfile under the caller's
runtime dir at mode 0600, whitelisted SMB version/options/modes. Polkit
action authorizes it with auth_admin_keep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jaroslav Beneš
2026-07-15 14:28:49 +02:00
parent fab2d65dd2
commit 6448ea4f22
2 changed files with 138 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
helper/sk.houmeres.synologynas.policy
+20
View File
@@ -0,0 +1,20 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD polkit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/software/polkit/policyconfig-1.dtd">
<policyconfig>
<vendor>Synology NAS plasmoid</vendor>
<vendor_url>https://git.houmeres.sk/Houmeres/Plasma-Addon-Synology-NAS</vendor_url>
<icon_name>folder-network</icon_name>
<action id="sk.houmeres.synologynas.manage">
<description>Mount or unmount a network share</description>
<message>Authentication is required to mount or unmount a network share</message>
<defaults>
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
</defaults>
<annotate key="org.freedesktop.policykit.exec.path">/usr/lib/synology-nas/helper</annotate>
<annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
</action>
</policyconfig>