Symbol: CAP_AUDIT_WRITE
fs/notify/fanotify/fanotify_user.c
1749
if (!capable(CAP_AUDIT_WRITE))
kernel/audit.c
1117
if (!netlink_capable(skb, CAP_AUDIT_WRITE))