The Ubuntu kernel has "subj=unconfined" in its audit records. The Linus v5.16-rc4 kernel has "subj==unconfined". I see in the upstream where the extra "=" comes from, but I don't see how to get to that code. I have not looked into the patches Ubuntu is using, but there must be something.