def _new_rule():
     rule = Rule()
     rule.action = rule.ACTION_ALWAYS
     return rule
 def _new_rule():
     rule = Rule()
     rule.action = rule.ACTION_ALWAYS
     rule.syscalls = [rule.SYSCALLS_ALL]
     return rule