From c5754dece28aa950f8181e9032a0e57baac900dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ga=C5=A1per=20Fele-=C5=BDor=C5=BE?= <polz@fri.uni-lj.si>
Date: Mon, 1 Sep 2025 00:21:18 +0200
Subject: [PATCH] Do not mount cifs volumes for local users; disable debug

---
 roles/ad_joined/files/pam_mount.conf.xml | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/roles/ad_joined/files/pam_mount.conf.xml b/roles/ad_joined/files/pam_mount.conf.xml
index 01eb506..24167bc 100644
--- a/roles/ad_joined/files/pam_mount.conf.xml
+++ b/roles/ad_joined/files/pam_mount.conf.xml
@@ -3,18 +3,35 @@
 
 <pam_mount>
   <!-- Example using CIFS -->
+  <debug enable="0" />
   <volume
       fstype="cifs"
       server="ucilnicesmb.fri1.uni-lj.si"
       path="%(USER)"
       mountpoint="~/"
       options="sec=krb5i,cruid=%(USERUID)"
-  />
+  >
+    <not>
+      <or>
+        <user>local_admin</user>
+        <user>root</user>
+        <sgrp>sudo</sgrp>
+      </or>
+    </not>
+  </volume>
   <volume
       fstype="cifs"
       server="ucilnicesmb.fri1.uni-lj.si"
       path="profiles/%(DOMAIN_USER).V6"
       mountpoint="~/win_profile"
       options="sec=krb5i,cruid=%(USERUID)"
-  />
+  >
+    <not>
+      <or>
+        <user>local_admin</user>
+        <user>root</user>
+        <sgrp>sudo</sgrp>
+      </or>
+    </not>
+  </volume>
 </pam_mount>