ausearch -c 'grep' --raw | audit2allow -M my-grep