abstractions.base: add /tmp blacklist hack in case /tmp is fully shared and for audit rules