This patch may be needed for rawhide: "Only audit permissions specified in policy" https://bugzilla.redhat.com/show_bug.cgi?id=558499#c28 -- James Morris <jmorris at namei.org>