path: root/stik.8

.Dd September 27, 2026
.Dt STIK 8
.Os
.Sh NAME
.Nm stik
.Nd mount and unmount removable devices as an ordinary user
.Sh SYNOPSIS
.Nm
.Cm mount
.Op Fl nr
.Ar device
.Nm
.Cm umount
.Ar device
.Nm
.Fl h | V
.Sh DESCRIPTION
.Nm
lets a user mount a USB stick, SD card or other removable device
without root, and without a desktop stack such as PAM, elogind or
udisks.
.Pp
.Sy The user must be in the group plugdev.
.Nm
is installed setuid root, runnable only by root and the group
.Li plugdev
.Pq Li root:plugdev 4750 ,
and refuses any caller that is neither root nor a member of
.Li plugdev ,
whatever its file mode.
Add a user with
.Pp
.Dl # usermod -aG plugdev user
.Pp
and have them log in again.
.Pp
.Cm mount
mounts
.Ar device
at
.Pa /media/ Ns Ar name ,
where
.Ar name
is the device's name, such as
.Pa sdb1
for
.Pa /dev/sdb1 .
The directory is created if needed.
.Cm umount ,
also spelled
.Cm unmount ,
unmounts it again and removes the directory.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl h
Print a usage summary.
.It Fl n
Do not map ownership; see
.Sx OWNERSHIP .
.It Fl r
Mount read-only.
.It Fl V
Print the version.
.El
.Pp
Options may be combined, as in
.Fl rn ,
and may come anywhere on the command line.
.Sh DEVICES
.Ar device
must be written as
.Pa /dev/ Ns Ar name ,
where
.Ar name
consists of letters, digits,
.Ql -
and
.Ql _
only, and must be a block device.
Symbolic links such as
.Pa /dev/disk/by-label/ Ns Ar label
are not accepted.
.Pp
Only removable devices are mounted.
A device qualifies if it sits on USB or FireWire, if it is an SD card,
or if it or the disk it belongs to reports
.Pa removable
in sysfs.
Internal disks are refused, and so is soldered-in eMMC storage, even
though it hangs off the same controller as SD cards.
The device node must be the device that sysfs knows by that name.
.Pp
A partition must be named, not the disk that holds its partition
table:
.Pa /dev/sdb1 ,
not
.Pa /dev/sdb .
.Nm
says so when given a disk with a partition table.
A LUKS volume must be unlocked first.
.Sh FILE SYSTEMS
The file system is recognised from its superblock:
vfat, exfat, ntfs, ext2, ext3, ext4, btrfs, xfs, f2fs, iso9660 and udf.
NTFS is mounted with the ntfs3 driver if the kernel has it, else ntfs.
.Pp
Every mount is
.Cm nosuid
and
.Cm nodev ;
iso9660 and udf are also read-only.
.Sh OWNERSHIP
vfat, exfat and ntfs store no owners: their files belong to the user
who mounted them, with mode 644 for files and 755 for directories.
iso9660 and udf files belong to that user as well.
.Pp
ext2, ext3, ext4, btrfs, xfs and f2fs store owners on disk.
For these,
.Nm
maps on-disk user and group 0 to the user who mounts, so a stick
formatted by root is readable and writable without changing anything
on it.
Files the user creates are stored as owned by 0.
Files of any other owner keep their ownership and may not be
accessible.
The mapping needs Linux 5.12 or later and support in the file system;
without it,
.Nm
warns and mounts without mapping.
It is not applied with
.Fl n ,
nor when root mounts.
.Pp
When
.Nm
is run by root through
.Xr doas 1
or
.Xr sudo 8 ,
ownership goes to the user named in
.Ev DOAS_USER
or
.Ev SUDO_USER .
.Sh UNMOUNTING
.Cm umount
only unmounts a device that is mounted at
.Pa /media/ Ns Ar name ;
a device mounted anywhere else is refused, so it cannot be used to
unmount the system's own file systems.
Any member of
.Li plugdev
may unmount a stick another member mounted.
.Pp
If a stick was pulled out while mounted, its device node is gone but
the mount stays.
.Cm umount
still detaches it.
.Sh FILES
.Bl -tag -width Ds
.It Pa /media/ Ns Ar name
Mount point of
.Pa /dev/ Ns Ar name .
.El
.Sh EXIT STATUS
.Bl -tag -width 3n -compact
.It 0
Success.
.It 1
Usage error.
.It 2
.Ar device
is not of the form
.Pa /dev/ Ns Ar name .
.It 3
.Ar device
does not exist or is not a block device.
.It 4
No recognised file system, or the device cannot be read.
.It 6
The mount failed.
.It 7
.Ar device
is not mounted.
.It 8
The unmount failed.
.It 9
Unknown command.
.It 10
.Ar device
is already mounted.
.It 11
The mount point cannot be created.
.It 12
.Ar device
is mounted, but not under
.Pa /media .
.It 13
.Ar device
is not a removable device.
.It 14
The caller is neither root nor in
.Li plugdev .
.El
.Sh EXAMPLES
Mount a stick, write to it, unmount it:
.Bd -literal -offset indent
$ stik mount /dev/sdb1
==> Mounting /dev/sdb1 (vfat) to /media/sdb1
==> Mounted at /media/sdb1
$ cp notes.txt /media/sdb1/
$ stik umount /dev/sdb1
.Ed
.Pp
Look at an ext4 stick read-only, with ownership as stored on it:
.Pp
.Dl $ stik mount -rn /dev/sdb1
.Sh SEE ALSO
.Xr doas 1 ,
.Xr mount_setattr 2 ,
.Xr group 5 ,
.Xr mount 8 ,
.Xr usermod 8
.Sh SECURITY CONSIDERATIONS
.Nm
runs no other programs and reads no configuration.
It consults no environment variables except
.Ev DOAS_USER
and
.Ev SUDO_USER ,
and those only when run by root.