1 files changed, 33 insertions, 3 deletions

diff --git a/fs/namespace.c b/fs/namespace.c
index 1105a577a14f..dd9c93b5a9d5 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -890,8 +890,21 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
 
         mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED);
         /* Don't allow unprivileged users to change mount flags */
-        if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY))
-                mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
+        if (flag & CL_UNPRIVILEGED) {
+                mnt->mnt.mnt_flags |= MNT_LOCK_ATIME;
+
+                if (mnt->mnt.mnt_flags & MNT_READONLY)
+                        mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
+
+                if (mnt->mnt.mnt_flags & MNT_NODEV)
+                        mnt->mnt.mnt_flags |= MNT_LOCK_NODEV;
+
+                if (mnt->mnt.mnt_flags & MNT_NOSUID)
+                        mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID;
+
+                if (mnt->mnt.mnt_flags & MNT_NOEXEC)
+                        mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC;
+        }
 
         /* Don't allow unprivileged users to reveal what is under a mount */
         if ((flag & CL_UNPRIVILEGED) && list_empty(&old->mnt_expire))
@@ -1931,6 +1944,23 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
             !(mnt_flags & MNT_READONLY)) {
                 return -EPERM;
         }
+        if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) &&
+            !(mnt_flags & MNT_NODEV)) {
+                return -EPERM;
+        }
+        if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) &&
+            !(mnt_flags & MNT_NOSUID)) {
+                return -EPERM;
+        }
+        if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) &&
+            !(mnt_flags & MNT_NOEXEC)) {
+                return -EPERM;
+        }
+        if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) &&
+            ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) {
+                return -EPERM;
+        }
+
         err = security_sb_remount(sb, data);
         if (err)
                 return err;
@@ -2129,7 +2159,7 @@ static int do_new_mount(struct path *path, const char *fstype, int flags,
                  */
                 if (!(type->fs_flags & FS_USERNS_DEV_MOUNT)) {
                         flags |= MS_NODEV;
-                        mnt_flags |= MNT_NODEV;
+                        mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV;
                 }
         }