Question about Auditd SELinux policy