20-udisks.rules

// Allow the morfik user to mount some devices without having to authenticate
//
// More info at: http://storaged.org/doc/udisks2-api/latest/udisks-polkit-actions.html

// This allows to mount windows' internal partitions that match criteria of filesystem type,
// partition label and drive serial number
polkit.addRule(function(action, subject) {
  if (action.id.indexOf("org.freedesktop.udisks2.filesystem-mount-system") == 0 &&
      action.lookup("drive.serial") == "WD-WXD1AB73AR02" &&
      action.lookup("id.label").match(/win[\_a-z]*/) &&
      action.lookup("id.type") == "ntfs" &&
      subject.local && subject.active &&
      subject.user == "morfik") {
        return polkit.Result.YES;
      }
});

// This allows to mount, eject and power off an external device that matches the specified serial
// number
polkit.addRule(function(action, subject) {
  if ((action.id.indexOf("org.freedesktop.udisks2.filesystem-mount") == 0 ||
       action.id.indexOf("org.freedesktop.udisks2.power-off-drive") == 0 ||
       action.id.indexOf("org.freedesktop.udisks2.eject-media") == 0) &&
       action.lookup("drive.serial") == "0019E06B9C8ABE41C7A2C3EC" &&
       subject.local && subject.active &&
       subject.user == "morfik") {
         return polkit.Result.YES;
      }
});

// This allows to setup loop devices
polkit.addRule(function(action, subject) {
  if (action.id.indexOf("org.freedesktop.udisks2.loop-setup") == 0 &&
      subject.local && subject.active &&
      subject.user == "morfik") {
        return polkit.Result.YES;
      }
});

// This allows to mount loop devices, unlock them if encrypted, and change password to the
// encrypted volume
polkit.addRule(function(action, subject) {
  if ((action.id.indexOf("org.freedesktop.udisks2.filesystem-mount") == 0 ||
       action.id.indexOf("org.freedesktop.udisks2.filesystem-unmount-others") == 0 ||
       action.id.indexOf("org.freedesktop.udisks2.encrypted-unlock") == 0 ||
       action.id.indexOf("org.freedesktop.udisks2.encrypted-lock-others") == 0 ||
       action.id.indexOf("org.freedesktop.udisks2.encrypted-change-passphrase") == 0 ||
       action.id.indexOf("org.freedesktop.udisks2.eject-media") == 0 ||
       action.id.indexOf("org.freedesktop.udisks2.loop-delete-others") == 0) &&
       subject.local && subject.active &&
       (action.lookup("device").match(/\/dev\/loop[a-z0-9]*/)) &&
       subject.user == "morfik") {
         return polkit.Result.YES;
      }
});

// This allows to mount the decrypted loop device that matches the particular label and device path
polkit.addRule(function(action, subject) {
  if (action.id.indexOf("org.freedesktop.udisks2.filesystem-mount") == 0 &&
      action.lookup("id.label") == "dropbox" &&
      (action.lookup("drive").match(/\/dev\/mapper\/dropbox/)) &&
      subject.local && subject.active &&
      subject.user == "morfik") {
        return polkit.Result.YES;
      }
});

// This prohibits users from running all the other udisks2 actions
polkit.addRule(function(action) {
  if (action.id.indexOf("org.freedesktop.udisks2.") == 0) {
        return polkit.Result.NO;
      }
});