AUDIT_FILTER_ENTRY is perfectly valid for NEVER actions

The kernel still, and will still maintain, the AUDIT_FILTER_ENTRY flag. The
exception is that it will fail when the action is ONLY AUDIT_ALWAYS.

THIS IS REAL KERNEL CODE MY FRIENDS, STRAIGHT FROM THE MASTER BRANCH OF THE
KERNEL OF THE DATE OF THIS COMMIT!!!

        listnr = rule->flags & ~AUDIT_FILTER_PREPEND;
        switch(listnr) {
          default:
                goto exit_err;
          case AUDIT_FILTER_ENTRY:
                if (rule->action == AUDIT_ALWAYS)
                        goto exit_err;

So let us say you don't want to audit any syscall with a specific uid/gid? Upon
syscall entry, we already know the fucking uid/gid, right? THEN WHY WOULD WE WANT
THE SYSCALL TO BE CREATED AND ADDED TO IF WE NEVER HAD TO IN THE FIRST PLACE?

Summary: redhat auditd, you never fail to amaze me, by always failing.