Is the "possible" option used when checking a syscall filter rule?
Does this option make sense when setting a syscall entry filter or exit
filter? Or, it is meant just for task filtering?
During task creation this option is checked. If true, the per-task
audit_context is created and always filled at syscall entry time.
What is the meaning (how it is used) of "possible" in the following
example:
auditctl -a entry,possible -S chmod
`