RHEL 6 audit.rules question