Here is a sample test to syscall filtering on personality:
Use the Makefile to create the 64bit version and the 32bit version of the test.
Execute 'pers64'. See new audit record in /var/log/audit.log.
Execute 'pers32'. No new audit records in /var/log/audit.log.
(chmod is syscall 90)

(See attached file: pers64.c)
(See attached file: pers32.c)
(See attached file: Makefile)

-debbie