Rules are added for auditing discretionary access control changes made via lremovexattr.
lremovexattr