Re: [patch 0/8] mount ownership and unprivileged mount syscall (v4)

Miklos Szeredi
2007-04-21T08:35:11Z

> > This patchset has now been bared to the "lowest common denominator"
> > that everybody can agree on. Or at least there weren't any objections
> > to this proposal.
> I would be very glad if this feature can be disabled on compilation.
> Because this feature is fine for desktops, but not for servers. Another
> user access to kernel = another security hole. I have mount without
> setuid on my server. I don't want user access to mount/umount.

It needs expicit action from the sysadmin (setting a mount flag),
before user mounts are enabled. So if you do nothing it will be
exactly as secure as it was before.

If you are extra paranoid, you can do

echo 0 > /proc/sys/fs/max_user_mounts

to doubly make sure that user mounts are not enabled ;)

Miklos