If nothing else, it's not immediately apparent as to whether or not the content of the rules is vetted in some way. While I don't immediately see an exploitable path that a client could take to mess things up, I'm super paranoid. At the very least, I'd kind of prefer the list to be explicit. 

        sec_rule_attrs = [set of attributes that are available]
        for attr in sec_rule_attrs:
            if attr in rule:
                getattr(secrule, attr)(rule[attr])