$< = 0 made it, at least until perl 5.12. I had not expected that I was allowed to do that, so I didn't try this obvious step.

Thanks a lot!

Unfortunately, neither sudo nor fstab can help. It is required that user A cannot access the media of user B. fstab solutions would at best bind a user to some device node, which is determined by the order of plugging the device and does not relate to users.

In principle I could define a whole bunch of sudo rules per user, but this would require to rewrite the /etc/sudoers on all systems, whenever the central user LDAP changes. Such things tend to be unmaintainable.