So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp:type=AVC msg=audit(1338465611.221:356): avc:  granted  { getattr } for  pid=5973 comm=sftp-server path=/polog dev=dm-0 ino=1966081 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:polog_t:s0 tclass=dirsftp in this case is running as user1, is there a way to have selinux log this username as well or should I be taking a different approach?Here's my policy files:---polog.te---policy_module(polog, 1.0.14)require {    type fs_t;        type unconfined_t;        type sshd_t;        type setfiles_t;        class filesystem associate;        class dir relabelto;}type polog_t;#============= polog_t ==============allow polog_t fs_t:filesystem associate;allow unconfined_t polog_t:dir relabelto;allow setfiles_t polog_t:dir relabelto;#====================================auditallow unconfined_t polog_t : file *;auditallow unconfined_t polog_t : dir *;allow unconfined_t polog_t : file *;allow unconfined_t polog_t : dir *;---polog.fc---/polog(/.*)?            gen_context(system_u:object_r:polog_t)
Can selinux log an application owner name?
logs;selinux;sftp