USERATTR_CLEARANCE
{ USERATTR_CLEARANCE, check_label, label },
{ '\0', USERATTR_CLEARANCE },
if ((kv_str = kva_match(userp->attr, USERATTR_CLEARANCE))