audit: audit_string_contains_control can be boolean