Is there a way to test whether semodule has be run with disable-dontaudit? Or better yet a netlink socket event? Ted