LSM hooks for audit