ausearch manualpage confusing

[Geertsky]

In the manual page of ausearch the -o, -su and -se state the following:

• -o, --object SE-Linux-context-string Search for event with tcontext (object) matching the string.
• -su, --subject SE-Linux-context-string Search for event with scontext (subject) matching the string.
• -se, --context SE-Linux-context-string Search for events with either scontext/subject or tcontext/object matching the given string.

The term SE-Linux-context-string in these three options carries different meanings across these three options. This is confusing as it can be interpreted as -o + -su makes -se.

[stevegrubb]

But that is the case. See https://github.com/linux-audit/audit-userspace/blob/master/src/ausearch-match.c#L365