Using the kernel's audit.h