locks: Don't allow mounts in user namespaces to enable mandatory locking
Since no one uses mandatory locking and files with mandatory locks can
cause problems don't allow them in user namespaces.
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
diff --git a/fs/namespace.c b/fs/namespace.c
index 4219885..4d2c8f64 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1589,7 +1589,7 @@
#ifndef CONFIG_MANDATORY_FILE_LOCKING
return false;
#endif
- return true;
+ return capable(CAP_SYS_ADMIN);
}
/*