audit_add_watch
#define audit_add_watch(k, l) (-EINVAL)
int audit_add_watch(struct audit_krule *krule, struct list_head **list)