From: David Howells <dhowells@redhat.com>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: dhowells@redhat.com, Al Viro <viro@zeniv.linux.org.uk>,
Christian Brauner <christian@brauner.io>,
Marc Dionne <marc.dionne@auristor.com>,
Jeffrey Altman <jaltman@auristor.com>,
Steve French <sfrench@samba.org>,
linux-afs@lists.infradead.org, openafs-devel@openafs.org,
linux-cifs@vger.kernel.org, linux-nfs@vger.kernel.org,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
Etienne Champetier <champetier.etienne@gmail.com>,
Chet Ramey <chet.ramey@case.edu>,
Cheyenne Wills <cwills@sinenomine.net>,
Christian Brauner <brauner@kernel.org>,
linux-integrity@vger.kernel.org
Subject: Re: [PATCH v3 1/2] vfs: Allow filesystems with foreign owner IDs to override UID checks
Date: Wed, 12 Aug 2026 14:12:54 +0100 [thread overview]
Message-ID: <986908.1786540374@warthog.procyon.org.uk> (raw)
In-Reply-To: <4bdf58bd593d9a54aa20760fd49aaa1df57ef216.camel@linux.ibm.com>
Mimi Zohar <zohar@linux.ibm.com> wrote:
> On Tue, 2026-07-28 at 15:13 +0100, David Howells wrote:
> >
> > (*) IMA policy ops.
> >
> > Unchanged for now. I'm not sure what the best way to deal with this
> > is - if, indeed, it needs any changes.
>
> IMA policy rules may be written in terms of the uid, euid and fowner. Any
> changes, if necessary, would need to be made to ima_match_rules().
I think I can probably leave this for now as using uids mapped through the
namespace mapping mechanism. To do otherwise would, I think, require the
possibility of encoding foreign IDs in IMA rules. Something to consider in
the future, maybe, but I don't think I need to deal with that here.
Possibly, we could make a general rule that "for any otherwise unmapped
foreign ID, do X" sort of thing.
David
prev parent reply other threads:[~2026-08-12 13:13 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260728141344.1811120-1-dhowells@redhat.com>
2026-07-28 14:13 ` [PATCH v3 1/2] vfs: Allow filesystems with foreign owner IDs to override UID checks David Howells
2026-07-30 23:35 ` Mimi Zohar
2026-08-12 13:12 ` David Howells [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=986908.1786540374@warthog.procyon.org.uk \
--to=dhowells@redhat.com \
--cc=brauner@kernel.org \
--cc=champetier.etienne@gmail.com \
--cc=chet.ramey@case.edu \
--cc=christian@brauner.io \
--cc=cwills@sinenomine.net \
--cc=jaltman@auristor.com \
--cc=linux-afs@lists.infradead.org \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=marc.dionne@auristor.com \
--cc=openafs-devel@openafs.org \
--cc=sfrench@samba.org \
--cc=viro@zeniv.linux.org.uk \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox