[PATCH 1/7] audit: put rule existence check in canonical order