Ok yeah, I had actually misread what the vars were.

But it's the same kind of problem as general environment vars - rather than just a name, maybe it needs metadata of where it came from.

To be clear, I'm talking about the unprivileged to allow_active CVE-2025-6018, not the allow_active to root.