selinux: fall back to ref-walk if audit is required