OP_CHANGE_HAT
aa_audit_file(subj_cred, profile, &nullperms, OP_CHANGE_HAT,
OP_CHANGE_HAT,
aa_audit_file(subj_cred, profile, &perms, OP_CHANGE_HAT,
hat = split_token_from_name(OP_CHANGE_HAT, args, &token);