usersubject: common login user subject
    make it a bit broader and dontaudit read all files as well
    also dontaudit tcp/udp bind and tcp connect all ports