diff --git a/modules/pam_namespace/namespace.conf.5.xml b/modules/pam_namespace/namespace.conf.5.xml

index c7698cb..a94b49e 100644

--- a/modules/pam_namespace/namespace.conf.5.xml

+++ b/modules/pam_namespace/namespace.conf.5.xml

@@ -122,9 +122,14 @@

     <para><emphasis>mntopts</emphasis>=<replaceable>value</replaceable>

       - value of this flag is passed to the mount call when the tmpfs mount is

       done. It allows for example the specification of the maximum size of the

-      tmpfs instance that is created by the mount call. See <citerefentry>

-      <refentrytitle>mount</refentrytitle><manvolnum>8</manvolnum>

-      </citerefentry> for details.

+      tmpfs instance that is created by the mount call. In addition to

+      options specified in the <citerefentry>

+      <refentrytitle>tmpfs</refentrytitle><manvolnum>5</manvolnum>

+      </citerefentry> manual the <emphasis>nosuid</emphasis>,

+      <emphasis>noexec</emphasis>, and <emphasis>nodev</emphasis> flags

+      can be used to respectively disable setuid bit effect, disable running

+      executables, and disable devices to be interpreted on the mounted

+      tmpfs filesystem.

     </para>

     <para>

diff --git a/modules/pam_namespace/pam_namespace.c b/modules/pam_namespace/pam_namespace.c

index f541f89..660c7a1 100644

--- a/modules/pam_namespace/pam_namespace.c

+++ b/modules/pam_namespace/pam_namespace.c

@@ -230,6 +230,73 @@ static int parse_iscript_params(char *params, struct polydir_s *poly)

     return 0;

 }

+struct mntflag {

+    const char *name;

+    size_t len;

+    unsigned long flag;

+};

+

+#define LITERAL_AND_LEN(x) x, sizeof(x) - 1

+

+static const struct mntflag mntflags[] = {

+	{ LITERAL_AND_LEN("noexec"), MS_NOEXEC },

+	{ LITERAL_AND_LEN("nosuid"), MS_NOSUID },

+	{ LITERAL_AND_LEN("nodev"), MS_NODEV }

+    };

+

+static int filter_mntopts(const char *opts, char **filtered,

+		unsigned long *mountflags)

+{

+    size_t origlen = strlen(opts);

+    const char *end;

+    char *dest;

+

+    dest = *filtered = NULL;

+    *mountflags = 0;

+

+    if (origlen == 0)

+	return 0;

+

+    do {

+	size_t len;

+	int i;

+

+	end = strchr(opts, ',');

+	if (end == NULL) {

+	    len = strlen(opts);

+	} else {

+	    len = end - opts;

+	}

+

+	for (i = 0; i < (int)(sizeof(mntflags)/sizeof(mntflags[0])); i++) {

+	    if (mntflags[i].len != len)

+		continue;

+	    if (memcmp(mntflags[i].name, opts, len) == 0) {

+		*mountflags |= mntflags[i].flag;

+		opts = end;

+		break;

+	    }

+	}

+

+	if (opts != end) {

+	    if (dest != NULL) {

+		*dest = ',';

+		++dest;

+	    } else {

+		dest = *filtered = calloc(1, origlen + 1);

+		if (dest == NULL)

+		    return -1;

+	    }

+	    memcpy(dest, opts, len);

+	    dest += len;

+	}

+

+	opts = end + 1;

+    } while (end != NULL);

+

+    return 0;

+}

+

 static int parse_method(char *method, struct polydir_s *poly,

 		struct instance_data *idata)

 {

@@ -289,7 +356,8 @@ static int parse_method(char *method, struct polydir_s *poly,

 					break;

 				}

 				free(poly->mount_opts); /* if duplicate mntopts specified */

-				if ((poly->mount_opts = strdup(flag+namelen+1)) == NULL) {

+				poly->mount_opts = NULL;

+				if (filter_mntopts(flag+namelen+1, &poly->mount_opts, &poly->mount_flags) != 0) {

 					pam_syslog(idata->pamh, LOG_CRIT, "Memory allocation error");

 					return -1;

 				}

@@ -1484,7 +1552,7 @@ static int ns_setup(struct polydir_s *polyptr,

     }

     if (polyptr->method == TMPFS) {

-	if (mount("tmpfs", polyptr->dir, "tmpfs", 0, polyptr->mount_opts) < 0) {

+	if (mount("tmpfs", polyptr->dir, "tmpfs", polyptr->mount_flags, polyptr->mount_opts) < 0) {

 	    pam_syslog(idata->pamh, LOG_ERR, "Error mounting tmpfs on %s, %m",

 		polyptr->dir);

             return PAM_SESSION_ERR;

diff --git a/modules/pam_namespace/pam_namespace.h b/modules/pam_namespace/pam_namespace.h

index 47ebcc3..1522386 100644

--- a/modules/pam_namespace/pam_namespace.h

+++ b/modules/pam_namespace/pam_namespace.h

@@ -166,6 +166,7 @@ struct polydir_s {

     unsigned int flags;			/* polydir flags */

     char *init_script;			/* path to init script */

     char *mount_opts;			/* mount options for tmpfs mount */

+    unsigned long mount_flags;		/* mount flags for tmpfs mount */

     uid_t owner;			/* user which should own the polydir */

     gid_t group;			/* group which should own the polydir */

     mode_t mode;			/* mode of the polydir */