Hacker News Reader

It's a pretty good argument for FUSE-stye userspace filesystems. Then the code reading the filesystem need not have any more permissions than the user mounting it.

That might prevent privilege escalation but I'm not sure it prevents a kernel wedge.

If you can wedge the kernel with a FUSE filesystem, that is certainly a severe bug, because it means an unprivileged user is able to DOS the system for everyone.

HURD has it also.

https://www.gnu.org/software/hurd/hurd/documentation/transla...

It's the reason libguestfs exists.

... or block storage systems in container environments, where the user somehow has write access to the block device.

Aren't those the usual way to provision some databases?

One argument is that allowing non-root to mount(2) is already a big security problem.