How to Mount Drives and Filesystems Without sudo

Why Avoid Sudo for Mounting?

The mount command mounts filesystems and devices into the main system folder structure at /mnt, /media or other mount points. But it requires root privileges to write to these protected areas, forcing the use of sudo.

However, in many cases avoiding root is ideal:

• More secure to use least privileges possible
• Shared systems may prevent sudo access
• sudo commands can leave audit trails
• Root risks filesystem damage if used improperly

The good news is you can successfully mount devices without relying on escalated sudo permissions. Let’s explore how.

Prerequisites

Before using the mounting tools and methods discussed here, ensure:

• You have access to connect and configure external drives and network shares
• Filesystems are formatted and partitioned appropriately
• Resources are configured to auto-mount (if supported)

With devices ready, we can use more granular approaches for non-root mounting.

Method #1 – Using FUSE

Filesystems

One straightforward option is leveraging FUSE filesystems. FUSE (Filesystem in Userspace) allows creating mounts outside the main /mnt folders not requiring sudo.

For example, using SSHFS:

# As normal user:

mkdir ~/mysshfs
sshfs name@server:/remote/folder ~/mysshfs

# Mounted without sudo!

And with s3fs for Amazon S3 buckets:

# As normal user:

mkdir ~/mys3
s3fs mybucket ~/mys3

# Bucket now mounted privately

FUSE filesystems like SSHFS and s3fs provide mounting functionality without sudo. But they only work for their specific resource type. Next we’ll look at more general purpose mounting tools.

Method #2 – Using fusermount

The fusermount command offers a sudo-less way to mount devices, partitions, and filesystem images by leveraging FUSE capabilities.

To mount an external hard drive partition:

# As normal user:

fusermount -o allow_other /dev/sdb1 ~/externaldrive

#Mounted!

For ISO disc images:

# As normal user:

fusermount -o loop some.iso ~/someiso 

# ISO mounted

fusermount is installed by default on many distros and allows mounting a wide array of resources without escalated permissions. But it only mounts within the user’s home folder. To make devices available system-wide, we need to get more advanced.

Method #3 – Leveraging Udisksctl

The udisksctl utility communicates with the Linux Udisks daemon to mount devices with greater system integration than FUSE.

For example, to make an attached USB drive available at /media/myusb for all users:

# As normal user:

udisksctl mount -b /dev/sdb1 --mount-options ro,nosuid,nodev

# Mounted system-wide read-only

Mount an NTFS partition in read/write:

# As normal user: 

udisksctl mount -b /dev/sdb3 --mount-options rw,defaults

The catch is udisksctl requires DBus access and the Udisks service actively running – not ideal for all environments. But accessible and straightforward where available.

Method #4 – Creating Custom Mount Points

For more control, you can create custom mount points in your home directory and bind mounts to expose them globally:

# As normal user:

mkdir ~/mymountpoint
mount /dev/sdb1 ~/mymountpoint

sudo mount --bind ~/mymountpoint /mnt/externaldisk

This allows mounting devices locally without sudo while making bind mounts visible to other users. But it requires elevated privileges to create the global bind mount with sudo.

For purely local mounts, stick to the custom point without the binding.

Method #5: Using Mount Namespaces

A more advanced technique is leveraging Linux namespaces to create isolated mount environments as an unprivileged user with the unshare command:

# As normal user:

unshare -m

mount /dev/sdb1 /mnt/externaldisk

Anything mounted within the namespace will appear under /mnt but not be visible system-wide. This achieves mounting without needing any privileges. But also segregates access.

Method #6 – Using su with Actual User Accounts

For scenarios where you need sudo to mount globally but don’t want to grant full root powers, you can temporarily switch users to a dedicated account:

# As normal user:

su helperuser -c 'mount /dev/sdb1 /shared/mountpoint' 

# Mounted by helperuser

The helperuser should be configured for device auto-mounting and only granted required privileges. This allows standardized mounting without providing full root access.

Securing Unprivileged Mounts

When mounting devices as a normal user, be sure to configure security settings appropriately on mount points. Recommended options include:

• nosuid - Disallow set UID binaries
• nodev - Disallow device files
• noexec - Disallow program execution
• rw/ro - Set appropriate read/write permissions

These prevent unprivileged users from escalating privileges or modifying devices.

Summary Table: Mounting Without Sudo

Here’s a quick reference summary of options covered to mount as an unprivileged user:

Comparison: Mounting Methods

Evaluating these options against your specific environment will help identify the ideal techniques.

Conclusion

While the standard mount command requires root privileges, expanding your arsenal with tools like FUSE filesystem mounts, fusermount, udisksctl namespaces, and more allows successful mounting without sudo permissions.

The methods here provide you the knowledge to securely mount the devices and remote filesystems you need in Linux, irrespective of the privileges provided by your account. Restrict mounts with proper security flags and leverage user switching only when necessary to stay safe.

Now you can avoid the overuse of sudo by having precise mounting techniques tailored for any permission level!