work on journalctl, setsebool and setenforce
ssh: also dontaudit attempts by ssh to transition to invalid users