clean up audit_rule_{add,del} a bit