As much as I'd like to be on a more current kernel, the open_by_handle_at syscall seems to have been introduced in 2.6.39, per para 1.9 of:

http://kernelnewbies.org/Linux_2_6_39

I removed it from my local copy of:

https://fedorahosted.org/audit/browser/trunk/contrib/stig.rules