0

I have opened volume USB device and locked using CreateFile() and DeviceIoControl() in Windows.

I want same functionality on Linux/Unix system. I am new to Unix So How to get it?

My code for Windows :

HANDLE handle = CreateFile(L"\\\\.\\F:",          // F: drive to open
    GENERIC_READ,                // no access to the drive
    FILE_SHARE_READ, // share mode
    NULL,             // default security attributes
    OPEN_EXISTING,    // disposition
    0x1,                // file attributes
    NULL);            // do not copy file attributes

DWORD lpBytesReturned;

if (DeviceIoControl(handle, FSCTL_LOCK_VOLUME, NULL, 0, NULL, 0, &lpBytesReturned, (LPOVERLAPPED)NULL)){
        printf("\n  Lock SUCCESS !\n");
    }
else {
    printf("\n  Lock Failed !\n");
}

Langage : c/c++

platform: Linux/Unix

Thanks in Advance.

5
  • @AlanBirtles what is FSCTL_LOCK_VOLUME equivalent request code in Linux/Unix?
    – jayprakash
    Feb 10, 2020 at 9:21
  • @jayprakash please explain why you want to lock a USB drive, i.e., what do you want to achieve in the first place? Maybe there is no way in Linux to replicate exactly the same behavior, but there could be different solutions for the root cause of the problem.
    – PooSH
    Feb 13, 2020 at 6:46
  • @PooSH For End point security I want both block and Allow Read only for USB storage devices.
    – jayprakash
    Feb 15, 2020 at 5:55
  • @PooSH Can you please suggest equivalent behavior for Linux/Unix?
    – jayprakash
    Feb 15, 2020 at 5:56

1 Answer 1

0

Consider using Linux namespaces, for instance, Docker containers. That way, you can grant or limit access to system resources such as network cards, storage devices, etc.

For example, you have a web server and database server. You can create two containers: one for the webserver, and the second one for the database. Each of the containers has its own filesystem, or to be precise, own view on the filesystem (namespace). Therefore, a security breach on the webserver cannot directly affect databases because they are not seen from the webserver's filesystem. Moreover, both containers have separate user permissions, so the web admin with root access still cannot mess up the databases.

The same way you can prevent access to a USB storage drive: on the host system, you can make backups from all Docker containers to a USB drive while the containers have no access to the backups as the USB storage doesn't exist for them at all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.