audit_pack_string
audit_pack_string(&bufp, f->lsm_str);
audit_pack_string(&bufp,
audit_pack_string(&bufp,
audit_pack_string(&bufp, krule->filterkey);
audit_pack_string(&bufp, audit_mark_path(krule->exe));