0c36f40
- Add check for fields that cannot be used with syscall entry in auditctl - Make auditctl not tolerate duplicate rule and watches