1 files changed, 10 insertions, 0 deletions

diff --git a/fs/namespace.c b/fs/namespace.c
index 33a75c8e9fcb..a830e1463704 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1584,6 +1584,14 @@ static inline bool may_mount(void)
         return ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN);
 }
 
+static inline bool may_mandlock(void)
+{
+#ifndef CONFIG_MANDATORY_FILE_LOCKING
+        return false;
+#endif
+        return capable(CAP_SYS_ADMIN);
+}
+
 /*
  * Now umount can handle mount points as well as block devices.
  * This is important for filesystems which use unnamed block devices.
@@ -2676,6 +2684,8 @@ long do_mount(const char *dev_name, const char __user *dir_name,
                                    type_page, flags, data_page);
         if (!retval && !may_mount())
                 retval = -EPERM;
+        if (!retval && (flags & MS_MANDLOCK) && !may_mandlock())
+                retval = -EPERM;
         if (retval)
                 goto dput_out;