Sorry if this has been talked about before, but would it be possible to create a specific group to apply auditing tags for chroots, similarly to how we have a kernel auditing group. This way I could create a GID and add it to specific chroots for eg. execve() tracking, while not generating mass amounts of logs from every other chroot I have.
Cheers,