Which userspace packages modified for audit