AA_CLASS_CAP
DEFINE_AUDIT_DATA(ad, LSM_AUDIT_DATA_CAP, AA_CLASS_CAP, OP_CAPABLE);
state = RULE_MEDIATES(rules, AA_CLASS_CAP);