audit_make_tree
extern int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op);
err = audit_make_tree(&entry->rule, str, f->op);