<snip> > > >>>> the following (something between option #2 and #3): > > >>>> subj1_lsm=smack subj1=<smack_label> subj2_lsm=selinux > > >>>> > > >>>> subj2=<selinux_label> ... > > >>> If it's not a subj= field why use the indirection? > > >>> > > >>> subj_smack=<smack_label> subj_selinux=<selinux_label>
FWIW +1 on this approach. <snip> -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
