--- util-linux-ng-2.13-rc3/mount/umount.c.xxx	2007-05-30 10:18:12.000000000 +0200

+++ util-linux-ng-2.13-rc3/mount/umount.c	2007-08-13 12:02:07.000000000 +0200

@@ -434,7 +434,7 @@

 umount_file (char *arg) {

 	struct mntentchn *mc, *fs;

 	const char *file, *options;

-	int fstab_has_user, fstab_has_users, fstab_has_owner, fstab_has_group;

+	int fstab_has_user, fstab_has_users, fstab_has_owner, fstab_has_group, fstab_has_pamconsole;

 	int ok;

 	if (!*arg) {		/* "" would be expanded to `pwd` */

@@ -521,13 +521,16 @@

 		fstab_has_users = contains(options, "users");

 		fstab_has_owner = contains(options, "owner");

 		fstab_has_group = contains(options, "group");

+		fstab_has_pamconsole = contains(options, "pamconsole");

 		ok = 0;

 		if (fstab_has_users)

 			ok = 1;

 		if (!ok && (fstab_has_user || fstab_has_owner ||

-			    fstab_has_group)) {

+			    fstab_has_group || fstab_has_pamconsole)) {

+		        char pamconsole_file_name[256];

+			struct stat sb;

 			char *user = getusername();

 			options = mc->m.mnt_opts;

@@ -537,6 +540,14 @@

 			if (user && mtab_user && streq (user, mtab_user))

 				ok = 1;

+

+			/*pam_console user check*/

+			if (user && fstab_has_pamconsole) {

+				snprintf (pamconsole_file_name, sizeof (pamconsole_file_name), "/var/run/console/%s", user);

+	      			if (stat (pamconsole_file_name, &sb) == 0) {

+					ok = 1;

+	      			}

+			}

 		}

 		if (!ok)

 			die (2, _("umount: only %s can unmount %s from %s"),

--- util-linux-ng-2.13-rc3/mount/fstab.5.xxx	2007-07-03 01:56:04.000000000 +0200

+++ util-linux-ng-2.13-rc3/mount/fstab.5	2007-08-13 12:02:07.000000000 +0200

@@ -156,10 +156,10 @@

 .BR nfs (5).

 Common for all types of file system are the options ``noauto''

 (do not mount when "mount -a" is given, e.g., at boot time), ``user''

-(allow a user to mount), and ``owner''

-(allow device owner to mount), and ``comment''

+(allow a user to mount), ``owner''

+(allow device owner to mount), ``pamconsole'' (allow a user at the console to mount), and ``comment''

 (e.g., for use by fstab-maintaining programs).

-The ``owner'' and ``comment'' options are Linux-specific.

+The ``owner'', ``pamconsole'' and ``comment'' options are Linux-specific.

 For more details, see

 .BR mount (8).

--- util-linux-ng-2.13-rc3/mount/mount.c.xxx	2007-08-13 12:00:15.000000000 +0200

+++ util-linux-ng-2.13-rc3/mount/mount.c	2007-08-13 12:05:15.000000000 +0200

@@ -108,14 +108,15 @@

 #define MS_USER		0x20000000

 #define MS_OWNER	0x10000000

 #define MS_GROUP	0x08000000

+#define MS_PAMCONSOLE	0x04000000

 #define MS_COMMENT	0x02000000

 #define MS_LOOP		0x00010000

 /* Options that we keep the mount system call from seeing.  */

-#define MS_NOSYS	(MS_NOAUTO|MS_USERS|MS_USER|MS_COMMENT|MS_LOOP)

+#define MS_NOSYS	(MS_NOAUTO|MS_USERS|MS_USER|MS_COMMENT|MS_LOOP|MS_PAMCONSOLE)

 /* Options that we keep from appearing in the options field in the mtab.  */

-#define MS_NOMTAB	(MS_REMOUNT|MS_NOAUTO|MS_USERS|MS_USER)

+#define MS_NOMTAB	(MS_REMOUNT|MS_NOAUTO|MS_USERS|MS_USER|MS_PAMCONSOLE)

 #define MS_PROPAGATION  (MS_SHARED|MS_SLAVE|MS_UNBINDABLE|MS_PRIVATE)

@@ -155,6 +156,8 @@

   { "comment",	0, 0, MS_COMMENT},	/* fstab comment only (kudzu,_netdev)*/

   /* add new options here */

+  { "pamconsole",   0, 0, MS_PAMCONSOLE }, /* Allow users at console to mount */

+  { "nopamconsole", 0, 1, MS_PAMCONSOLE }, /* Console user has no special privs */

 #ifdef MS_NOSUB

   { "sub",	0, 1, MS_NOSUB	},	/* allow submounts */

   { "nosub",	0, 0, MS_NOSUB	},	/* don't allow submounts */

@@ -379,7 +382,7 @@

 				*mask &= ~om->mask;

 			else

 				*mask |= om->mask;

-			if ((om->mask == MS_USER || om->mask == MS_USERS)

+			if ((om->mask == MS_USER || om->mask == MS_USERS || om->mask == MS_PAMCONSOLE)

 			    && !om->inv)

 				*mask |= MS_SECURE;

 			if ((om->mask == MS_OWNER || om->mask == MS_GROUP)

@@ -807,7 +810,29 @@

 	  }

       }

-      /* James Kehl <mkehl@gil.com.au> came with a similar patch:

+      /* Red Hat patch: allow users at console to mount when fstab

+ 	 contains the console option. This option should not be used

+	 in a high security environment but is useful to give console

+ 	 users the possibility of using locally attached devices

+         such as USB keychains and USB harddisks where it is now suitable

+	 to give the console owner write access to the device node */

+      if (*flags & MS_PAMCONSOLE) {

+	char *username;

+	char pamconsole_file_name[256];

+	struct stat sb;

+

+	username = getusername ();

+

+	if (username != NULL) {

+	  snprintf (pamconsole_file_name, sizeof (pamconsole_file_name),

+		    "/var/run/console/%s", username);

+	  if (stat (pamconsole_file_name, &sb) == 0) {

+	    *flags |= MS_USER;

+	  }

+	}

+      }

+

+       /* James Kehl <mkehl@gil.com.au> came with a similar patch:

 	 allow an arbitrary user to mount when he is the owner of

 	 the mount-point and has write-access to the device.

 	 This is even less secure. Let me skip it for the time being;

@@ -823,7 +848,7 @@

 	  *user = getusername();

   }

-  *flags &= ~(MS_OWNER | MS_GROUP);

+  *flags &= ~(MS_OWNER | MS_GROUP | MS_PAMCONSOLE);

 }

 static int