make the e->rule.xxx shorter in kernel auditfilter.c