audit_add_tree_rule
extern int audit_add_tree_rule(struct audit_krule *rule);
err = audit_add_tree_rule(&entry->rule);