79576e
- Add check for fields that cannot be used with syscall entry in auditctl - Make auditctl not tolerate duplicate rule and watches