/proc/thread-self/root/usr/share/audit/sample-rules/