audit_dupe_rule 1009 kernel/auditfilter.c nentry = audit_dupe_rule(&oentry->rule, nwatch); audit_dupe_rule 1799 kernel/auditfilter.c nentry = audit_dupe_rule(&entry->rule, watch);