Audit: use new LSM hooks instead of SELinux exports