mac_system_check_auditon
error = mac_system_check_auditon(td->td_ucred, uap->cmd);
int mac_system_check_auditon(struct ucred *cred, int cmd);