audit=1 on 'append' and 'linuxefi' lines