mac_system_check_auditctl
error = mac_system_check_auditctl(td->td_ucred, vp);
int mac_system_check_auditctl(struct ucred *cred, struct vnode *vp);