audit_add_watch
extern int audit_add_watch(struct audit_krule *krule, struct list_head **list);
err = audit_add_watch(&entry->rule, &list);