audit_log_rule_change 1604 kernel/auditfilter.c 		audit_log_rule_change(loginuid, sessionid, sid, "add",
audit_log_rule_change 1621 kernel/auditfilter.c 		audit_log_rule_change(loginuid, sessionid, sid, "remove",