AUDIT: Prevent duplicate syscall rules