auditctl bug: load rules from file