mjhjmtu

For some time I had a working udev rule to automount media devices.

/etc/udev/rules.d/61-mount_media_by_label.rules

#
# To propagate udev's mountpoint to the user space, MountFlags must have a value "shared" in the /usr/lib/systemd/system/systemd-udevd.service.
#

# Ignore devices that aren't storage block-devices and block-devices that are already listed in /etc/fstab.
KERNEL!="sd[a-z][1-9]*", GOTO="mount_media_by_label_end"
PROGRAM="/bin/grep -e '^UUID=%EID_FS_UUID' /etc/fstab", RESULT!="", GOTO="mount_media_by_label_end"

# Decide the name for device's mountpoint directory, based on device's label.
ENVID_FS_LABEL!="", ENVmountpoint="%EID_FS_LABEL"
ENVID_FS_LABEL=="", ENVmountpoint="usb-%k"

# If device is being plugged in, set options for mount command.
ACTION=="add", ENVmount_options="relatime"
ACTION=="add", ENVID_FS_TYPE=="vfat|ntfs", ENVmount_options="%Emount_options,utf8,gid=100,umask=002"

# If device is being plugged in, create mountpoint directory in /media and mount device node to it.
ACTION=="add", RUN+="/bin/mkdir -p /media/%Emountpoint", RUN+="/bin/mount -o %Emount_options /dev/%k /media/%Emountpoint"

# If device is being plugged out, unmount it and delete its mountpoint directory.
ACTION=="remove", ENVmountpoint!="", RUN+="/bin/umount -l /media/%Emountpoint", RUN+="/bin/rmdir /media/%Emountpoint"

# Label for early exit.
LABEL="mount_media_by_label_end"

To make this rule work, I only had to change the value of MountFlags option to shared in
/usr/lib/systemd/system/systemd-udevd.service

After I updated systemd to version 239, this file looks different.

I noticed 2 changes that might be problematic:

1. The MountFlags option is not specified in default settings.


2. There is a new option PrivateMounts set to yes.

From systemd's documentation I figured that now I only need to set PrivateMounts=no and propagation of mountpoint would reach the user space.

However, this is not the case.

I have tried

1. Changing PrivateMounts=no
   


2. Changing PrivateMounts=no and adding MountFlags=shared
   

but neither works.

What is the correct way to mount media devices from udev rules in systemd v239 and later?

This approach may be sub-optimal. For example, if you support mounting writable NTFS using ntfs-3g, the ntfs-3g process will be killed whenever you restart udev.

Note that modern security doctrine suggests desktops should start using FUSE for mounting all removable filesystems. https://lwn.net/Articles/755593/

It would be preferable if you could work out how to launch (and stop?) a separate systemd unit ... and write this up as the preferred approach, in whatever peculiar documents keep suggesting Arch users to use this pattern :-). Using a separate systemd unit will avoid the restrictions applied to the udev service.

For example, launch a command in a systemd scope unit using systemd-run --no-block --scope -- my mount command here.

Unfortunately, if you want the unit that contains ntfs-3g to have an identifiable name, it's not immediately obvious what the 100% correct way is. If an old unit with that name is still tracked as "active" but the process has just exited, then simply asking the service to start won't do anything. You could ignore the problem, generate a random suffix for the name, or try to rule out this sequence of events... but maybe there's a better way.

I have not tested this with FUSE, but I think the way to do this would be the systemd-mount command.

A SuperUser answer suggests that using systemd-mount on a device while the udev rule is still running, might not work correctly. This would require rather baroque workarounds. (RUN+="/path/to/my/script %k" which runs systemd-run --no-block --scope --unit=mount-$1 sh -c "systemctl start /dev/$1; systemd-mount ...").

I think the way to do this would look something like

ENVSYSTEMD_WANTS=my-mounter@%k.service

# /etc/systemd/system/my-mounter@.service
[Service]
Type=oneshot
ExecStart=systemd-mount %I

#!/bin/sh
# /usr/local/lib/my-mounter
# You can make this as complicated as you want.
# (Although curiously systemd-mount also reads SYSTEMD_MOUNT_WHERE and
# SYSTEMD_MOUNT_OPTIONS properties if you set them on the udev device.)
# You could also read udev properties yourself using 
# eval "$(udevadm info --query=property --export)"

DEVNAME="$1"
systemd-mount "/dev/$DEVNAME"

The defaults for systemd-mount cause the filesystem to be unmounted automatically on removal, but they do not cleanup the automatically-created mount point directory afterwards (!).

There were two separate changes in v239 - two separate directives that you must revert to get the old behaviour.

1. 
   PrivateMounts=yes. Replace this with PrivateMounts=no.


2. 
   

   SystemCallFilter=@system-service @module @raw-io

   
   
   

   The use of this directive is new in v239. Therefore the simplest way to regain the previous behaviour is to remove it entirely.