Re: [PATCH v26 22/25] Audit: Add new record for multiple process LSM attributes

>> The record is produced only in cases where there is more than one >> security module with a process "context". >> In cases where this record is produced the subj= fields of >> other records in the audit event will be set to "subj=?". >> >> An example of the MAC_TASK_CONTEXTS (1420) record is: >> >> type=UNKNOWN[1420] >> msg=audit(1600880931.832:113) >> subj_apparmor==unconfined > > It should be just a single "=" in the line above. AppArmor provides the 2nd "=" as part of the subject context. What's here is correct. I won't argue that it won't case confusion or worse.