Cannot add rules with multiple key filters

[KSpaceer]

Hello! Thanks for this great project!

I've encountered a problem: parsed rules with multiple key filters (-F key=<key>) cannot be added to the kernel - an "invalid argument" error is returned.

I use the library like this:

ruleWithTwoKeyFormats := "-a always,exit -F arch=b64 -S open,truncate,ftruncate,creat,openat,open_by_handle_at -F exit=-EACCES -F key=firstkey -F key=secondkey"

r, err := flags.Parse(ruleWithTwoKeyFormats)
if err != nil {
     return err
}

data, err := rule.Build(r)
if err != nil {
     return err
}

if err := client.AddRule(data); err != nil {
    return err
}

fmt.Println("added rule")

When -k <key> syntax is used instead of -F key=<key>, it works correctly. Mixing both formats again leads to this error.

[raphendyr]

I was using the interface via Auditbeat. The following audit.rule line did not work:

-a always,exit -F arch=b64 -F path=/foobar -F perm=wa -F key=foo_modification -F key=critical

However, this did work correctly:

-a always,exit -F arch=b64 -F path=/foobar -F perm=wa -k foo_modification -k critical

auditbeat version 8.16.0 (amd64), libbeat 8.16.0