Mount a USB device in Podman (Sheep dip)

[Zzvok]

To put things in context, I'm working currently on a Sheep dip project. The principle is simple, to allow the use of a USB device in the corporate network, this usb device need to be check before (antivirus scan) with a dedicated computer.
In my case, the dedicated computer is a centOs, and as I see it, I want that the dedicated computer mounts the usb device in a podman container, thus giving more protection (in addition of the antivirus scan, we can check the unwanted modifications that may happen inside the container, and if it's comprise, simply delete it).

However, baby steps first, I'm stuck with the mounting process. I create a new non-root user :
adduser Limited && passwd Limited

And I grant him the mount/umount privileges :
echo 'Limited ALL = NOPASSWD:/sbin/mount,/sbin/umount,/bin/mount,/bin/umount' >> /etc/sudoers.d/limitedOverrides
(We can possibly imagine giving only the mounting privilege on a specific device)

As root I change the owner of the device :
chown -R Limited:Limited /dev/sdb*

and finally running the container as a unprivileged user (Limited, id=1001):
podman run --rm -it --security-opt label=disable --device=/dev/sdb1:/dev/sdb1:rwm ubuntu:latest /bin/bash

Inside the container I am the owner of the device :

And I can run the cat command on it (I have the perm). However, the mount command still gives me back :

(it's the same even if I add 'sudo')

Although outside the container Limited user can mount the sdb1 device, and the root user inside the container is map with the Limited user outside the container :

Adding --group-add keep-groups didn't change anything, as I understand it, it will be useful when I would like to mount the usb device inside the container as a non-root user (using Udisk maybe) with the command :
podman run --rm -it **-u sync** -security-opt label=disable --device=/dev/sdb1:/dev/sdb1:rwm **--group-add keep-groups** ubuntu:latest /bin/bash

Am I missing something ?

Thanks a lot for your time.

[giuseppe]

you cannot mount a block device as an unprivileged user, even when running in a user namespace.

[rhatdan]

Adding a USB device is handled by udev, as I recall. So you might be able to launch a rootfull container process to examine the contents of the usb device, to examine it and have udev unmount it if the test did not succeed.

[Zzvok]

Thanks for your suggestion.