audit_remove_tree_rule  130 kernel/audit.h extern int audit_remove_tree_rule(struct audit_krule *);
audit_remove_tree_rule 1400 kernel/auditfilter.c 		audit_remove_tree_rule(&e->rule);