[PATCH] audit syscall classes