audit_dupe_rule
extern struct audit_entry *audit_dupe_rule(struct audit_krule *old);
nentry = audit_dupe_rule(&oentry->rule);
nentry = audit_dupe_rule(r);