Heyo so I haven't touched the kernel code but I did write the OpenBSM parsing code. I can investigate and see if I missed path on my part and if there is a way to get it. You might be able to check yourself by using the built in audit tool on macOS with the audit pipe