From: Miklos Szeredi <mszeredi@suse.cz>
Define a new fs flag FS_SAFE, which denotes, that unprivileged mounting of

this filesystem may not constitute a security problem.
Since most filesystems haven't been designed with unprivileged mounting in

mind, a thorough audit is needed before setting this flag.
For "safe" filesystems also allow unprivileged forced unmounting.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>

---
Index: linux/fs/namespace.c

===================================================================

--- linux.orig/fs/namespace.c	2007-04-26 13:30:04.000000000 +0200

+++ linux/fs/namespace.c	2007-04-26 13:51:29.000000000 +0200

@@ -724,14 +724,16 @@ static bool is_mount_owner(struct vfsmou

 /*

  * umount is permitted for

  *  - sysadmin

- *  - mount owner, if not forced umount

+ *  - mount owner

+ *    o if not forced umount,

+ *    o if forced umount, and filesystem is "safe"

  */

 static bool permit_umount(struct vfsmount *mnt, int flags)

 {

 	if (capable(CAP_SYS_ADMIN))

 		return true;
-	if (flags & MNT_FORCE)

+	if ((flags & MNT_FORCE) && !(mnt->mnt_sb->s_type->fs_flags & FS_SAFE))

 		return false;
 	return is_mount_owner(mnt, current->fsuid);

@@ -787,13 +789,17 @@ asmlinkage long sys_oldumount(char __use

  * - mountpoint is not a symlink

  * - mountpoint is in a mount owned by the user

  */

-static bool permit_mount(struct nameidata *nd, int *flags)

+static bool permit_mount(struct nameidata *nd, struct file_system_type *type,

+			 int *flags)

 {

 	struct inode *inode = nd->dentry->d_inode;
 	if (capable(CAP_SYS_ADMIN))

 		return true;
+	if (type && !(type->fs_flags & FS_SAFE))

+		return false;

+

 	if (S_ISLNK(inode->i_mode))

 		return false;
@@ -1027,7 +1033,7 @@ static int do_loopback(struct nameidata

 	struct vfsmount *mnt = NULL;

 	int err;
-	if (!permit_mount(nd, &flags))

+	if (!permit_mount(nd, NULL, &flags))

 		return -EPERM;

 	if (!old_na...
[ message continues ]