mount - How can I grant guest accounts read (or read-write) permission on a folder outside their home? - Ask Ubuntu

i have stuff stored in external partition (ext4) mounted through /etc/fstab location /vms. inside directory, have folder shared should accessible (currently read-only, later maybe read-write) local users, including guest sessions.

however, chmod -r a+r /vms/shared makes files world-readable standard users, not guest sessions, afaik have layer of restrictions through apparmor or denies access outside home.

i have separate account guest-config serves default profile new guest sessions (/etc/guest-session/skel symlink /home/guest-config) able tweak guest profile settings, in case help.

how can unlock specific directory (and files , subdirectories) grant guest accounts read-only or read-write access? using ubuntu 16.04 btw.

(copied answer here, since saw first, , doesn't seem right mark duplicate of question asked later.)

guest sessions locked down using apparmor, uses long list of special permissions keep guest users touching anything. these accessed etc/apparmor.d/lightdm-guest-session.

on machine, file looks this:

# profile restricting lightdm guest session  #include <tunables/global>  /usr/lib/lightdm/lightdm-guest-session {   # applications confined via main abstraction   #include <abstractions/lightdm>    # chromium-browser needs special confinement due sandboxing   #include <abstractions/lightdm_chromium-browser> } 

opening "main abstraction" (etc/apparmor.d/abstractions/lightdm) gives more interesting:

... / r, /bin/ rmix, /bin/fusermount px, /bin/** rmix, /cdrom/ rmix, /cdrom/** rmix, /dev/ r, /dev/** rmw, # audio devices etc. owner /dev/shm/** rmw, /etc/ r, /etc/** rmk, ... 

these directories restricted session can access, along permissions. if add partition , shared folder list (with trailing /** include subdirectories, , r read permission), future guest sessions have read-only access it.

for read-write permissions, use rw; default permission /var/guest-data. full permissions, use rwlkmix; default permission guest-owned drives in /media. these stand read, write, link, lock, memory-map, , inherit-execute: last 1 gives execution privileges, specifies execution must happen within current confinement (so can't break out of guest restrictions running specially-crafted shell script).