The following patch adds dontaudit rules for where the net_admin capability is requested due to SO_SNDBUFFORCE. This forces the caller to use SO_SNDBUF which gives the same result but possibly a smaller buffer. From Russell Coker