From a2da8ccb958de2522192babb51acbb54d9f4881f Mon Sep 17 00:00:00 2001 From: Seth Forshee Date: Tue, 9 Feb 2016 13:31:28 -0600 Subject: [PATCH] UBUNTU: SAUCE: fuse: Add module parameter to enable user namespace mounts This is still an experimental feature, so disable it by default and allow it only when the system administrator supplies the userns_mounts=true module parameter. Signed-off-by: Seth Forshee Signed-off-by: Tim Gardner --- fs/fuse/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c index 2fd338c199ce..4ce60b2fd0f7 100644 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -48,6 +48,10 @@ MODULE_PARM_DESC(max_user_congthresh, "Global limit for the maximum congestion threshold an " "unprivileged user can set"); +static bool userns_mounts; +module_param(userns_mounts, bool, 0644); +MODULE_PARM_DESC(userns_mounts, "Allow mounts from unprivileged user namespaces"); + #define FUSE_SUPER_MAGIC 0x65735546 #define FUSE_DEFAULT_BLKSIZE 512 @@ -1047,6 +1051,9 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) int err; int is_bdev = sb->s_bdev != NULL; + if (!userns_mounts && !capable(CAP_SYS_ADMIN)) + return -EPERM; + err = -EINVAL; if (sb->s_flags & MS_MANDLOCK) goto err; -- 2.39.5