audit_alloc_mark
extern struct audit_fsnotify_mark *audit_alloc_mark(struct audit_krule *krule,
audit_mark = audit_alloc_mark(new, pathname, strlen(pathname));
audit_mark = audit_alloc_mark(&entry->rule, str, f_val);