From: Serge E. Hallyn <serue@us.ibm.com>

A file system mounted NOSUID is likely a removable filesystem.  Allowing
file capabilities from such an fs is an easy attack vector, so don't honor
file capabilities for a NOSUID filesystem.

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 security/commoncap.c |    4 ++++
 1 file changed, 4 insertions(+)

diff -puN security/commoncap.c~file-capabilities-dont-do-file-caps-if-mnt_nosuid security/commoncap.c
--- a/security/commoncap.c~file-capabilities-dont-do-file-caps-if-mnt_nosuid
+++ a/security/commoncap.c
@@ -23,6 +23,7 @@
 #include <linux/ptrace.h>
 #include <linux/xattr.h>
 #include <linux/hugetlb.h>
+#include <linux/mount.h>
 
 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
@@ -152,6 +153,9 @@ static int set_file_caps(struct linux_bi
 	struct inode *inode;
 	int err;
 
+	if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
+		return 0;
+
 	dentry = dget(bprm->file->f_dentry);
 	inode = dentry->d_inode;
 	if (!inode->i_op || !inode->i_op->getxattr) {
_