audit: make link()/linkat() match "attribute change" predicate