<snip> > > >>>> the following (something between option #2 and #3): > > >>>> subj1_lsm=smack subj1=<smack_label> subj2_lsm=selinux > > >>>> > > >>>> subj2=<selinux_label> ... > > >>> If it's not a subj= field why use the indirection? > > >>> > > >>> subj_smack=<smack_label> subj_selinux=<selinux_label> FWIW +1 on this approach. <snip>