Add auditd and friends to the image.
Add the auditdistd user required by auditdistd