audit_rule
audit_fanotify(response & ~FAN_AUDIT, &event->audit_rule);
struct fanotify_response_info_audit_rule audit_rule;
memcpy(&event->audit_rule, friar, sizeof(*friar));
audit_rule(ab, r);