auth: neverallow rules are on top of the rules stack
auth: one needs to be able to add and remove entries from var_log
directories to be able to create faillog and lastlog files in var_log
Various
	files: var_run and var_lock are no longer supported
	initial audit