This is other solution. I dont think needs any plugin support. It will generate one event for eatch denial and there is possible to filter on permission. .
- [no subject] Peter Enderborg
- [RFC PATCH] selinux: Add denied trace with permssion ... Peter Enderborg