Mimi Zohar <[email protected]> wrote: > On Tue, 2026-07-28 at 15:13 +0100, David Howells wrote: > > > > (*) IMA policy ops. > > > > Unchanged for now. I'm not sure what the best way to deal with this > > is - if, indeed, it needs any changes. > > IMA policy rules may be written in terms of the uid, euid and fowner. Any > changes, if necessary, would need to be made to ima_match_rules().
I think I can probably leave this for now as using uids mapped through the namespace mapping mechanism. To do otherwise would, I think, require the possibility of encoding foreign IDs in IMA rules. Something to consider in the future, maybe, but I don't think I need to deal with that here. Possibly, we could make a general rule that "for any otherwise unmapped foreign ID, do X" sort of thing. David
