# This is a sample configuration file for bilibop-rules.

# Here is a partition scheme:
#
# /dev/sdc : USB HDD hosting the running system (250GB)
#     /dev/sdc1 : Physical Volume (20GB)
#                 vg0 : Volume Group with only one PV (/dev/sdc1)
#         /dev/vg0/boot : Logical Volume mounted on /boot (1GB)
#         /dev/vg0/root : Logical Volume mounted on /     (10GB)
#         /dev/vg0/home : Logical Volume mounted on /home (7GB)
#         /dev/vg0/swap : Logical Volume used as swap device (2GB)
#     /dev/sdc2 : FAT32 partition with portable applications for Windows,
#                 no mountpoint (10GB)
#     /dev/sdc3 : Ext4 partition mounted on /var/spool/apt-mirror (100GB)
#     /dev/sdc4 : Primary extended partition
#     /dev/sdc5 : FAT32 logical partition with sorted public data,
#                 no mountpoint (50GB)
#     /dev/sdc6 : FAT32 logical partition with unsorted public data,
#                 no mountpoint (50GB)
#     /dev/sdc7 : LUKS logical partition with private data,
#                 no mountpoint (20GB)
#
# Bilibop rules, by default and by using Udisks capabilities, hide all
# volumes, and make them all 'system internal'. So I (unprivileged user)
# can't access /dev/sdc2, /dev/sdc5, /dev/sdc6 and /dev/sdc7 contents from
# the desktop applications based on Udisks (as file-managers Thunar,
# Nautilus or PCManFM). They are not automatically mounted (even not
# listed in /etc/fstab) and I can't mount them by just clicking on their
# icons on the desktop, because those icons are missing. Argh! This is not
# what I want.
#
# Knowing that (by running blkid):
# /dev/sdc2: LABEL="PortableApps" UUID="FE34-55C2" TYPE="vfat"
# /dev/sdc5: LABEL="public_data" UUID="7B50-DC7E" TYPE="vfat"
# /dev/sdc6: LABEL="unsorted" UUID="BDD1-9A36" TYPE="vfat"
# /dev/sdc7: UUID="7ef316ac-f92c-44a5-d9a2-837c1ee23f3bd" TYPE="crypto_LUKS"
#
# it is possible to whitelist the devices I want access from the desktop by
# making them visible:
BILIBOP_RULES_PRESENTATION_HIDE_WHITELIST="TYPE=vfat UUID=7ef316ac-f92c-44a5-d9a2-837c1ee23f3bd"
#
# In addition, if I want to be able to mount/unmount them without prompt for
# a su/sudo password:
BILIBOP_RULES_SYSTEM_INTERNAL_WHITELIST="${BILIBOP_RULES_PRESENTATION_HIDE_WHITELIST}"
#
# But if I want to keep default behaviour for the partition containing apps
# for Windows, and additionally I want to avoid mistakes on the partition
# containing sorted data, and I need to access apt-mirror partition from the
# desktop, I have to detail the whitelists and other settings (for the last
# one, we assume the filesystem contained into the LUKS partition is labeled
# 'Unlocked'):
BILIBOP_RULES_SYSTEM_INTERNAL_WHITELIST="LABEL=unsorted UUID=7ef316ac-f92c-44a5-d9a2-837c1ee23f3bd"
BILIBOP_RULES_PRESENTATION_HIDE_WHITELIST="${BILIBOP_RULES_SYSTEM_INTERNAL_WHITELIST} LABEL=public_data LABEL=apt-mirror"
BILIBOP_RULES_PRESENTATION_ICON="LABEL=apt-mirror:debian-logo"
BILIBOP_RULES_PRESENTATION_NAME="UUID=7ef316ac-f92c-44a5-d9a2-837c1ee23f3bd:Locked"
#
# This makes:
# /dev/sdc2: hidden and system internal (default unchanged)
# /dev/sdc3: shown on the desktop with 'debian-logo' icon, system internal
# /dev/sdc5: visible, but prompt for su/sudo password to be mounted
# /dev/sdc6: visible and mountable without admin rights
# /dev/sdc7: shown with a label reflecting its actual status (Locked/Unlocked)
#            and mountable without admin rights

# If you often download .iso images and want to see them as CDs on the desktop
# when they are mounted:
BILIBOP_RULES_PRESENTATION_HIDE_WHITELIST="TYPE=iso9660"
BILIBOP_RULES_PRESENTATION_ICON="TYPE=iso9660:media-cdrom"

# After what it is possible to update udev database referring to bilibop
# devices with: 'lsbilibop -c' (see lsbilibop(8)).

# XXX: the Udisks capabilities only apply on some desktop applications, and
# must not be considered as a real security layer. The use of pmount(1) can
# bypass all udisks/bilibop-rules settings.
