getuid() vs. geteuid() in auditctl