3 files changed, 69 insertions, 3 deletions

diff --git a/fs/namespace.c b/fs/namespace.c
index 30df6e7dd807..820af6a1dd6b 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -963,7 +963,8 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
         }
 
         /* Don't allow unprivileged users to reveal what is under a mount */
-        if ((flag & CL_UNPRIVILEGED) && list_empty(&old->mnt_expire))
+        if ((flag & CL_UNPRIVILEGED) &&
+            (!(flag & CL_EXPIRE) || list_empty(&old->mnt_expire)))
                 mnt->mnt.mnt_flags |= MNT_LOCKED;
 
         atomic_inc(&sb->s_active);
@@ -1544,6 +1545,9 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags)
                 goto dput_and_out;
         if (mnt->mnt.mnt_flags & MNT_LOCKED)
                 goto dput_and_out;
+        retval = -EPERM;
+        if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
+                goto dput_and_out;
 
         retval = do_umount(mnt, flags);
 dput_and_out:
@@ -1606,7 +1610,6 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
         if (IS_ERR(q))
                 return q;
 
-        q->mnt.mnt_flags &= ~MNT_LOCKED;
         q->mnt_mountpoint = mnt->mnt_mountpoint;
 
         p = mnt;
@@ -2097,7 +2100,13 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
         }
         if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
             !(mnt_flags & MNT_NODEV)) {
-                return -EPERM;
+                /* Was the nodev implicitly added in mount? */
+                if ((mnt->mnt_ns->user_ns != &init_user_ns) &&
+                    !(sb->s_type->fs_flags & FS_USERNS_DEV_MOUNT)) {
+                        mnt_flags |= MNT_NODEV;
+                } else {
+                        return -EPERM;
+                }
         }
         if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) &&
             !(mnt_flags & MNT_NOSUID)) {
@@ -2958,6 +2967,8 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
         /* mount new_root on / */
         attach_mnt(new_mnt, real_mount(root_parent.mnt), root_mp);
         touch_mnt_namespace(current->nsproxy->mnt_ns);
+        /* A moved mount should not expire automatically */
+        list_del_init(&new_mnt->mnt_expire);
         unlock_mount_hash();
         chroot_fs_refs(&root, &new);
         put_mountpoint(root_mp);
@@ -3002,6 +3013,7 @@ static void __init init_mount_tree(void)
 
         root.mnt = mnt;
         root.dentry = mnt->mnt_root;
+        mnt->mnt_flags |= MNT_LOCKED;
 
         set_fs_pwd(current->fs, &root);
         set_fs_root(current->fs, &root);
diff --git a/fs/pnode.c b/fs/pnode.c
index aae331a5d03b..260ac8f898a4 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -242,6 +242,7 @@ static int propagate_one(struct mount *m)
         child = copy_tree(last_source, last_source->mnt.mnt_root, type);
         if (IS_ERR(child))
                 return PTR_ERR(child);
+        child->mnt.mnt_flags &= ~MNT_LOCKED;
         mnt_set_mountpoint(m, mp, child);
         last_dest = m;
         last_source = child;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 590aeda5af12..3f3d7aeb0712 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2464,6 +2464,57 @@ static const struct file_operations proc_projid_map_operations = {
         .llseek         = seq_lseek,
         .release        = proc_id_map_release,
 };
+
+static int proc_setgroups_open(struct inode *inode, struct file *file)
+{
+        struct user_namespace *ns = NULL;
+        struct task_struct *task;
+        int ret;
+
+        ret = -ESRCH;
+        task = get_proc_task(inode);
+        if (task) {
+                rcu_read_lock();
+                ns = get_user_ns(task_cred_xxx(task, user_ns));
+                rcu_read_unlock();
+                put_task_struct(task);
+        }
+        if (!ns)
+                goto err;
+
+        if (file->f_mode & FMODE_WRITE) {
+                ret = -EACCES;
+                if (!ns_capable(ns, CAP_SYS_ADMIN))
+                        goto err_put_ns;
+        }
+
+        ret = single_open(file, &proc_setgroups_show, ns);
+        if (ret)
+                goto err_put_ns;
+
+        return 0;
+err_put_ns:
+        put_user_ns(ns);
+err:
+        return ret;
+}
+
+static int proc_setgroups_release(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq = file->private_data;
+        struct user_namespace *ns = seq->private;
+        int ret = single_release(inode, file);
+        put_user_ns(ns);
+        return ret;
+}
+
+static const struct file_operations proc_setgroups_operations = {
+        .open           = proc_setgroups_open,
+        .write          = proc_setgroups_write,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = proc_setgroups_release,
+};
 #endif /* CONFIG_USER_NS */
 
 static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns,
@@ -2572,6 +2623,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         REG("uid_map",    S_IRUGO|S_IWUSR, proc_uid_map_operations),
         REG("gid_map",    S_IRUGO|S_IWUSR, proc_gid_map_operations),
         REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations),
+        REG("setgroups",  S_IRUGO|S_IWUSR, proc_setgroups_operations),
 #endif
 #ifdef CONFIG_CHECKPOINT_RESTORE
         REG("timers",     S_IRUGO, proc_timers_operations),
@@ -2916,6 +2968,7 @@ static const struct pid_entry tid_base_stuff[] = {
         REG("uid_map",    S_IRUGO|S_IWUSR, proc_uid_map_operations),
         REG("gid_map",    S_IRUGO|S_IWUSR, proc_gid_map_operations),
         REG("projid_map", S_IRUGO|S_IWUSR, proc_projid_map_operations),
+        REG("setgroups",  S_IRUGO|S_IWUSR, proc_setgroups_operations),
 #endif
 };