So then, would you replace "unconfined:pid nnnnn" with the profile you really want? That'd force all unconfined tasks to check if they are being replaced on .. Some? All? LSM hooks?