AUDIT_FILTER_PREPEND
if (entry->rule.flags & AUDIT_FILTER_PREPEND) {
entry->rule.flags &= ~AUDIT_FILTER_PREPEND;
listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
entry->rule.flags = rule->flags & AUDIT_FILTER_PREPEND;
if (entry->rule.flags & AUDIT_FILTER_PREPEND)