aa_audit_rule_match
int aa_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, void *vrule);
LSM_HOOK_INIT(audit_rule_match, aa_audit_rule_match),