Omahub
← All plugins
S

Mounted Drives

by sktev

External drives in the bar: mount, unmount, eject, and open USB/CDROM/NVMe drives.

GitHub

Security review

Potentially dangerous behavior detected · 4 findings

Deterministic scan — not a security guarantee

High
Risk level
High
Analyzed commit
aae8a87
Scanned
1 month ago
  • high destructive_filesystem Panel.qml:116

    Destructive operation on the root filesystem or a block device.

    /dev/sdb1 as /dev/dm-0.") —
  • high destructive_filesystem Panel.qml:207

    Destructive operation on the root filesystem or a block device.

    /dev/sda1.") to stdout —
  • Docs destructive_filesystem README.md:45

    Destructive operation on the root filesystem or a block device.

    /dev/sdb1 as /dev/dm-0."), and already-unlocked rows use the mapper path lsblk reports. Only `lock` talks to the backing partition. Eject unmounts the mapper, then locks the container, before powering
  • Docs sudo README.md:27

    Command runs with sudo, elevating the process beyond the plugin environment.

    sudo needed for the active session). Errors are shown in the popup row.

Automated analysis only — not a security guarantee.

AI advisory review

No obvious issues detected

Language-model assessment · ~deepseek/deepseek-v4-flash-latest — advisory only

Low
AI risk level
Low
Recommendation
install
Model
~deepseek/deepseek-v4-flash-latest
Analyzed commit
aae8a87
Reviewed
1 month ago

The plugin is a drive management widget that uses standard tools (udisksctl, lsblk, xdg-open) for mounting, unmounting, ejecting, and LUKS operations. The flagged destructive filesystem commands are user-initiated actions for managing drives, not malicious. The passphrase handling is secure (stdin, temp file with 0600 permissions, trap cleanup). No command injection risk was found; device paths come from lsblk and are not user-controlled.

  • The deterministic scan flagged destructive filesystem operations (unmount, power-off, lock) as high risk, but these are expected for a drive management widget and are triggered only by explicit user actions.
  • The README mentions 'no sudo needed' which triggered a medium sudo flag, but the plugin does not actually use sudo; it relies on udisksctl with the user session.
  • The unlock script constructs a shell command with device paths directly, but these paths are always /dev/sdX style from lsblk and cannot contain shell metacharacters, so injection is not possible.
How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.

Install
$ omarchy plugin add https://github.com/sktev/mounted-drives --enable
System #Hyprland #quickshell #system

Mounted Drives

Omarchy shell bar widget: shows connected external drives (USB, CD-ROM, hotplug, and optionally secondary internal NVMe/SATA disks) and lets you mount, unmount, eject, and open them from the bar.

The icon is hidden unless at least one eligible drive is connected (alwaysShow: false). The bar icon reflects what is connected: USB → usb, optical → disc, anything else → harddisk.

Usage

  • Left-click: open/close the popup
  • Middle-click: refresh the drive list
  • Popup: Mount / Unmount per partition, folder button opens the mountpoint, eject button (⏏) safely removes the whole disk
  • LUKS partitions: locked rows show a passphrase field — Unlock opens the container and mounts it (Enter submits); unlocked rows get the normal mount/open actions plus a lock button () to close the container. Ejecting a disk with an open container unmounts and closes it first.
  • Popup toggle "Show internal drives": include internal non-system disks (secondary NVMe/SATA). Off by default, persisted in shell.json.
  • Keys: r refresh, esc close

Settings (inline in ~/.config/omarchy/shell.json)

Key Default Meaning
pollIntervalSec 8 fallback lsblk poll interval (5–300)
includeInternal false also show internal non-system NVMe/SATA disks (popup toggle)
alwaysShow false keep the icon visible with no drive connected

How it works

  • scripts/list_drives.py runs lsblk -J and filters to eligible disks, excluding the root disk, loop/zram/dm-* devices. It emits one JSON object per poll.
  • Mounting/unmounting/ejecting runs udisksctl (no sudo needed for the active session). Errors are shown in the popup row.
  • Hotplug detection is event-driven: udevadm monitor watches kernel block events and refreshes within ~0.5s of a drive appearing/disappearing (the same mechanism Nautilus uses). The timer poll is only a fallback, and the widget still fast-polls (2s) while the popup is open.

LUKS support

LUKS partitions are reported with their container state:

{ "name": "sdb1", "fstype": "crypto_LUKS", "encrypted": true, "unlocked": false }

When the container is open, lsblk (util-linux ≥ 2.39) nests the crypt mapper under its backing partition, so list_drives.py finds it as the partition's type == "crypt" child and reports unlocked: true, the mapper path, the unlocked filesystem type, and the live mountpoints.

In the panel:

  • Locked rows show a passphrase field. Unlock passes the passphrase to udisksctl unlock -b <dev> --key-file <tmp> — udisksctl reads keys only from a file, never stdin, so the passphrase is staged as a 0600 file in the RAM-backed runtime dir and removed by a trap immediately after (it travels as an argv element and never touches persistent storage). The filesystem is mounted right after. A wrong passphrase shows udisks' error in the row.
  • Unlocked rows behave like normal partitions (mount/unmount/open) plus a lock button that unmounts and runs udisksctl lock -b <dev>.

udisks gotcha: mount/unmount refuse the LUKS backing partition with "is not a mountable filesystem" — both directions. So filesystem operations on an unlocked container target the cleartext mapper instead: after unlock the mapper is parsed from udisksctl's stdout ("Unlocked /dev/sdb1 as /dev/dm-0."), and already-unlocked rows use the mapper path lsblk reports. Only lock talks to the backing partition. Eject unmounts the mapper, then locks the container, before powering the disk down.

The passphrase field takes over the panel keyboard while focused (the same PanelKeyCatcher.blocked pattern the wifi panel uses), so r/esc and the cursor keys stay out of the way until the field loses focus.