1 files changed, 10 insertions, 2 deletions

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index e5c4f609f22c..c4ae32ec6c6b 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -330,8 +330,16 @@ static struct dentry *mqueue_mount(struct file_system_type *fs_type,
                          int flags, const char *dev_name,
                          void *data)
 {
-        if (!(flags & MS_KERNMOUNT))
-                data = current->nsproxy->ipc_ns;
+        if (!(flags & MS_KERNMOUNT)) {
+                struct ipc_namespace *ns = current->nsproxy->ipc_ns;
+                /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
+                 * over the ipc namespace.
+                 */
+                if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
+                        return ERR_PTR(-EPERM);
+
+                data = ns;
+        }
         return mount_ns(fs_type, flags, data, mqueue_fill_super);
 }