On Wed, 2021-11-10 at 10:28 -0500, Michael Peters wrote: > This looks good, but would be even better if the flag that controlled > this was settable in the ima_policy. That's much easier to work with > in a lot of DevOps toolchains and pipelines and is similar to how the > other ima configuration is done. Thanks, Michael. Agreed, which is one of the reasons for posting this patch as an RFC. The other reason is that it is an incomplete solution, since it doesn't address mount namespaces. Any suggestions for addressing mount namespaces would be appreciated. Assuming there is a benefit for a partial solution, I'll add the per policy rule support. thanks, Mimi
