AUDIT_PERM_WRITE
if ((mask & AUDIT_PERM_WRITE) &&
return ((mask & AUDIT_PERM_WRITE) && ctx->argv[0] == SYS_BIND);