[PATCH 3/7] audit: eliminate string copy for new tree rules